of  the  Marine  Safety  &  Security  Council 

Spring  2016 


Safety  Management 

wr^eSystems'^^i 


From  the  boardroom  to  the  boiler  room 

there  can  be  no  weak  links 


Proceedings  m 

ring  2016  Vol.  73,  Number  1 


Safety  Management  System  Objectives 


6  Safety  Management  Facilitates  Safe  Vessel  Operation 

Vessel  systems,  crew,  and  operations. 
by  LCDR  Aaron  W.  Demo 

9  Safety  Management  Systems  to  Prevent  Pollution  from  Ships 

Standard  procedures  protect  the  environment. 
by  LCDR  Michael  Lendvay 

11  Dead  Reckoning  by  Safety  Management? 

Check  your  course. 
by  LCDR  Corydon  F.  Heard  IV 


Safety  Management  Systems  and  the  Outer  Continental  Shelf 


15  Mitigating  Risks  on  the  Outer  Continental  Shelf 

Safety  and  environmental  management  systems  in  action. 
by  LT  Jason  Kling 

18  Creating  an  Effective  Safety  and  Environmental  Management  System  for 
Offshore  Oil  and  Gas  Operations 

Adopting  performance-based  requirements  into  a  hybrid  regulatory  regime. 
by  Mr.  Stanislaus  Kaczmarek,  P.E. 


Vessel  Inspections 


23  ISM  Code  and  Vessel  Safety  Management  Systems 

Reading  between  the  lines  to  optimize  compliance. 
by  Mr.  Jason  M.  Yets 

26  Strengthening  Our  Foundation 

Fostering  an  even  more  robust  safety  culture  within  the  liquefied  gas  industry. 
by  CDR  Jason  Smith 

31  Making  the  Safe,  Safer 

Implementing  safety  management  systems  on  domestic  passenger  vessels. 
by  Mr.  Eric  P.  Christensen 


USCG  Mission  Management  System 


35  One  System 

Connecting  SMS  requirements  to  vessel  operations. 
by  LT  Josh  Buck 

38  The  IMO  Mandatory  Member  State  Audit  Program 

Appraising  the  flag. 
by  Mr.  John  J.  Hannon 


Training 


41  Nothing  to  Fear 

Objective  auditors  drive  quality  throughout  organizations. 
by  Captain  Inderjit  Arora 

44  Audits  vs.  Inspections 

What's  the  difference? 
by  Mr.  Anthony  D.  Morris 


Investigations  and  Safety  Management  Systems 


47  A  Tale  of  Two  Ships 

Examining  SMS  similarities,  strengths,  and  weaknesses. 
by  Mr.  Keith  Fawcett 

52  Suspension  and  Revocation  for  Safety  Management  System  Violations 

Maintaining  standards  for  competence  and  conduct  essential  to  safety  at  sea. 
by  CDR  Christopher  F.  Coutu 

55  Putting  People  at  the  Center 

Integrating  human  factors  into  safety  management  systems. 
by  Ms.  Dawn  M.  Gray 


Lessons  Learned 


59  Deadly  Fun 

Personal  watercraft  operating  dangers. 
by  Ms.  Sarah  K.  Webster 


On  Deck 

4  Assistant  Commandant's  Perspective 

Nautical  Queries 

by  Rear  Admiral  Paid  F.  Thomas 

64 

Engineering 

5  Champion's  Point  of  View 

by  CAPT  David  M.  Flaherty 

65 

Deck 

Cover  images:  Chain  link  by  Irina  Tischenko/Hemera/Thinkstock; 
armor  background  by  Dimdimich/iStock/Thinkstock. 

Graphics  USCG  and  its  licensors,  unless  otherwise  indicated. 


Admiral  Paul  F.  Zukunft 

Commandant 
U.S.  Coast  Guard 

The  Marine  Safety 
&  Security  Council 
of  the 

United  States  Coast  Guard 


Rear  Admiral  Steven  D.  Poulin 

Judge  Advocate  General 
Chairman 

Mr.  Jeffrey  G.  Lantz 

Director  of  Commercial 
Regulations  and  Standards 
Member 

Rear  Admiral  Peter  J.  Brown 

Assistant  Commandant 
for  Response  Policy 
Member 


Assistant 
Commandant’s 
Perspective 

by  Rear  Admiral  Paul  F.  Thomas 
Assistant  Commandant  for  Prevention  Policy 
U.S.  Coast  Guard 

The  topic  of  this  Proceedings  edition  is  very  important  to  me  as  the  Assistant  Commandant 
for  Prevention  Policy,  but  it  is  also  a  critical  issue  for  the  global  maritime  industry,  the 
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tion  of  cargo  on  the  high  seas. 
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Since  the  adoption  of  the  International  Safety  Management  Code  more  than  20  years  ago, 
the  safety  management  system  (SMS)  has  been  consistently  pointed  to  as  the  maritime 
industry's  primary  means  of  mitigating  risk.  As  a  result,  the  maritime  industry  and  the 
Coast  Guard  have  steadily  become  more  reliant  on  safety  management  systems  to  identify 
and  mitigate  risk,  ensuring  a  systematic  and  consistent  approach  to  safety  and  environ¬ 
mental  stewardship. 

The  maritime  industry  is  growing  in  complexity  regarding  vessel  design  and  construc¬ 
tion,  requiring  a  commensurate  increase  in  governing  standards,  regulatory  schemes, 
numbers  and  types  of  parties  involved,  and  legal  and  liability  relationships.  All  of  these 
factors  raise  our  level  of  dependency  on  the  safety  management  system. 

There  is  no  doubt  in  my  mind  that  these  systems  are  key  to  operating  safely  in  a  complex 
environment,  but  they  must  be  robust — and  robustly  implemented.  The  challenge  for  the 
maritime  industry,  the  Coast  Guard,  and  third-party  auditors  is  to  ensure  that  the  SMS  is 
maintained,  utilized,  and  remains  an  effective  tool  to  identify  and  reduce  risk. 

There  is  nothing  more  dangerous  than  the  false  sense  of  security  that  comes  with  a  safety 
management  system  that  exists  on  paper  only.  Too  often  I've  had  to  meet  with  maritime 
executives  to  discuss  a  significant  safety  or  environmental  incident  they  experienced. 
These  executives  tell  me  about  their  great  safety  management  systems  and  the  strong 
culture  they've  put  into  place,  but  they've  still  had  a  serious  incident  that  a  safety  man¬ 
agement  system  is  designed  to  prevent. 

An  effective  SMS  must  not  only  be  very  well  developed  in  terms  of  process  and  proce¬ 
dures;  it  must  also  be  deployed  from  the  boardroom  to  the  boiler  room.  There  shouldn't 
be  any  disconnect  between  the  auditors  and  the  surveyors,  or  between  the  CEO  and  the 
seaman.  We  all  must  work  together  to  discover  and  eliminate  such  disconnects. 

I  greatly  appreciate  the  time,  effort,  and  expertise  of  this  issue's  contributors,  who  were 
selected  to  represent  all  aspects  of  the  maritime  industry  as  well  as  the  government. 
I  hope  that  you  will  enjoy  this  issue  of  Proceedings  and  gain  a  more  comprehensive  under¬ 
standing  of  the  wide  range  of  safety  management  system  experiences  and  concerns 
represented  here. 
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Editorial  Team 


Champion’s 
Point  of 
View 


by  CAPT  David  M.  Flaherty 
Chief,  Traveling  Inspection  Staff 
U.S.  Coast  Guard 


This  issue  of  Proceedings  focuses  on  the  role  an  effective  safety  management  system  (SMS) 
plays  in  identifying  and  mitigating  risk  to  safeguard  vessel  passengers  and  crew,  protect 
the  marine  environment,  and  prevent  damage  to  the  ship  and/or  its  cargo. 

There  has  been — and  always  will  be — inherent  risk  associated  with  any  commercial 
vessel  operation.  Within  the  maritime  realm,  engineering  systems  may  break  down, 
alarms  may  fail,  expected  weather  conditions  may  change,  or  a  crewmember  may  for¬ 
get  to  perform  a  task.  Any  or  all  of  these  circumstances  may  affect  —  and  in  fact  have 
affected — vessel  safety. 

For  more  than  20  years,  mariners  have  relied  upon  the  safety  management  system  to 
mitigate  risk.  However,  there  is  concern  within  the  Coast  Guard  that  some  areas  of  the 
maritime  industry  still  don't  accept  or  appreciate  the  benefits  of  maintaining  a  safety 
management  system. 

I'm  sure  everyone  can  agree  that  ignoring  or  dismissing  risk  will  never  end  well.  As  a 
firm  believer  in  Murphy's  Law,  I  always  remember  this  quote:  "Anything  that  can  go 
wrong,  will  go  wrong"  to  focus  myself  when  I  am  working  on  a  complex  project.  This 
reminds  me  to  be  fully  observant  and  knowledgeable  of  the  risks  involved  and  to  pur¬ 
posely  determine  how  they  might  be  removed  or  mitigated.  In  my  view,  Murphy's  Law 
promotes  a  safety-minded  environment  by  reminding  everyone  that  complacency  does 
not  resolve  risk,  and  that  safety  is  everyone's  concern. 

However,  clear  procedures  and  processes  alone  do  not  add  up  to  an  effective  SMS.  Train¬ 
ing  has  to  be  an  integral  part  of  a  safety  management  system  to  promote  understanding 
of  the  processes  as  well  as  emphasize  the  need  for  communication  to  ensure  that  any 
discrepancies  are  discovered,  resolved,  and  documented.  Finally,  everyone  within  the 
company — from  the  boardroom  down  to  the  boiler  room — must  embrace  and  promote 
an  active  safety  culture.  Without  a  comprehensive  company  safety  culture,  even  the 
best-written,  organized,  and  detailed  SMS  will  not  meet  expectations,  and  risk  will 
remain — with  the  potential  to  expand. 

In  conclusion,  I  want  to  offer  my  sincere  thanks  to  the  all  of  the  authors  who  submit¬ 
ted  articles  on  this  important  topic.  I  hope  this  edition  will  help  readers  understand 
and  appreciate  what  a  safety  management  system  can  do  for  a  company's  operation,  as 
promoting  a  proactive  safety  culture  is  critically  important  to  protect  passengers;  ships, 
crew,  and  cargo;  and  the  environment. 


Barbara  Chiarizia 

Executive  Editor 

Diana  Forbes 

Managing  Editor 

Leslie  C.  Goodwin 

Art  Director 


Proceedings  is  published  quarterly 
in  the  interest  of  safety  at  sea  under 
the  auspices  of  the  Marine  Safety  & 
Security  Council.  Special  permission 
for  republication,  either  in  whole  or 
in  part,  except  for  copyrighted  mate¬ 
rial,  is  not  required,  provided  credit  is 
given  to  Proceedings. 

The  articles  contained  in  Proceed¬ 
ings  are  submitted  by  diverse  public 
and  private  interests  in  the  maritime 
community  as  a  means  to  promote 
maritime  safety  and  security.  The 
views  expressed  by  the  authors  do 
not  necessarily  represent  those  of  the 
U.S.  Coast  Guard  or  the  Department 
of  Homeland  Security  or  represent 
official  policy. 

Editorial  Contact 

Email:  HQS-DG-NMCProceedings@ 
uscg.mil 

Mail:  Commandant  (CG-DCO-84) 
ATTN:  Editor,  Proceedings  Magazine 
U.S.  Coast  Guard  Stop  7318 
2703  Martin  Luther  King  Jr.  Ave.  S.E. 
Washington,  DC  20593-7318 

Web:  www.uscg.mil/proceedings 

Phone:  (202)  372-2316 

Subscription  Requests 

Proceedings  is  free. 

Subscriptions 

www.uscg.mil/proceedings 


www.uscg.mil/proceedings 


Spring  2016 


Proceedings  it 


5 


Safety  Management  System  Objectives 


Safety  Management  Facilitates 
Safe  Vessel  Operation 

Vessel  systems,  crew,  and  operations. 

by  LCDR  Aaron  W.  Demo 
Office  of  Commercial  Vessel  Compliance 
Domestic  Vessel  Division 
U.S.  Coast  Guard 


On  July  1, 1998,  the  International  Safety  Management  (ISM) 
Code  was  made  mandatory  for  passenger  vessels,  tankers, 
and  bulk  carriers  subject  to  the  International  Convention 
for  the  Safety  of  Life  at  Sea  (SOLAS)  on  foreign  voyages.  All 
other  vessel  types  were  given  an  additional  four  years  (until 
July  1,  2002)  to  comply. 

The  ISM  Code 

In  many  ways,  the  ISM  Code  was  a  radical  philosophical 
departure  from  traditional  IMO  regulations  that  largely 
focused  on  ship  design  and  equipment,  as  the  code  focused 
on  the  human  element  —  and  not  just  for  those  employed 
on  the  ship.  The  code  also  stressed  the  responsibility  for 
shore-based  company  personnel  to  support  and  facilitate 
safe  ship  operation. 

The  code  laid  out  a  brief  but  comprehensive  framework  of 
key  elements  that  are  fundamental  to  a  safety  management 
system  (SMS).  For  example,  companies  must  document  oper¬ 
ations,  procedures,  and  lines  of  communication  between  the 
shoreside  and  onboard  vessel  operations  as  well  as  establish 
a  standardized  process  to  identify  nonconformities  and  haz¬ 
ardous  situations  to  ensure  they're  addressed  in  a  timely 
manner. 

A  Safety  Culture 

A  vessel's  SMS  clearly  identifies  roles  and  responsibilities 
for  all  involved  parties  and  documents  how  all  issues  and 
failures  of  systems  should  be  addressed.  Since  International 
Safety  Management  Code  implementation,  the  Coast  Guard 
has  discovered  that  employees  and  management  must  have 
100  percent  buy-in  for  safety  management  systems  to  be 
effective  and  create  a  true  safety  culture  within  a  company. 


I  recently  spent  some  time  visiting  several  offshore  supply 
vessel  companies  in  the  Gulf  of  Mexico,  and  it  was  clear  that 
safety  management  systems  helped  improve  the  companies' 
daily  vessel  operations.  Through  my  own  experience  as  an 
offshore  supply  vessel  master  in  the  mid-1990s,  I  would  have 
loved  to  have  had  a  safety  management  system  as  a  tool  to 
streamline  vessel  operations,  ensure  the  vessel  maintained 
regulatory  compliance,  and  ensure  proper  notification  to 
the  company. 

I  spoke  to  several  vessel  masters  and  port  captains  during 
my  recent  trip  to  Port  Fourchon,  Louisiana,  and  it  was  clear 
that  the  vessels'  safety  management  systems  were  working 
as  designed,  with  all  involved  parties  committed  to  main¬ 
taining  the  vessels  to  the  highest  standard  to  ensure  crew 
safety  and  security  and  protect  the  environment. 

While  a  safety  management  system  covers  a  broad  scope  of 
operations,  the  three  primary  areas  addressed  aboard  ves¬ 
sels  can  be  broken  down  into: 

•  vessel  systems, 

•  vessel  crews, 

•  vessel  operations. 

Vessel  Systems 

Vessels  built  over  the  last  few  years  have  very  complex,  inte¬ 
grated  systems  that  often  become  more  advanced  at  a  rate 
that's  hard  to  keep  up  with.  To  maintain  vessel  safety,  it's 
critical  to  have  a  safety  management  system  that  highlights 
how  these  systems  work  as  well  as  how  to  rectify  problems 
or  failures  within  the  system.  The  SMS  also  provides  a 
means  to  identify  regimented  system  and  equipment  test¬ 
ing  and  maintenance  to  ensure  everything  works  prop¬ 
erly  and  all  equipment  operates  within  the  manufacturer's 
specifications. 
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By  establishing  a  repeatable  and  traceable  maintenance  sys¬ 
tem,  crews  can  confirm  tests  are  conducted  properly  and 
safely  to  ensure  compliance  and  identify  potential  flaws 
before  they  become  failures.  In  the  event  crews  do  identify 
failures,  the  SMS  lays  out  a  process  to  rectify  deficiencies 
and  ensure  timely  repairs. 

Vessel  Crews 

The  crew  is  the  most  important  aspect  of  safety  manage¬ 
ment  system  effectiveness,  as  crewmembers  must  be  well 
trained  and  fully  committed  to  implementation  if  the  sys¬ 
tem  is  going  to  work.  If  a  crewmember  just  pulls  a  binder 
off  the  shelf  and  checks  off  tasks  using  a  "here  are  things 
I  have  to  get  done  today"  mentality,  the  SMS  is  destined  for 
failure.  Crewmembers  must  be  concerned  with  improving 
vessel  safety — not  just  making  sure  they  survive  the  next 
audit  without  nonconformities. 

There  are  numerous  examples  of  cases  where  the  Coast 
Guard  boarded  a  vessel  and,  according  to  a  recent  audit  of 
the  SMS,  all  systems  were  working  as  they  were  supposed 
to,  but  the  material  condition  of  the  vessel  said  otherwise. 
Cases  like  these  demonstrate  a  lack  of  commitment  by  at 
least  one  of  the  involved  parties. 

Over  the  past  several  years,  there  have  been  more  require¬ 
ments  placed  on  vessel  crews  than  ever  before,  and  the  SMS 
helps  to  identify  what  training  and  qualifications  are  needed 
for  specific  positions.  The  system  even  identifies  individual 
crewmember  roles  and  responsibilities,  so  everyone  on  the 
vessel  is  aware  of  what's  expected  of  them.  Emergency  plans 
are  also  incorporated  into  the  vessel's  SMS  to  ensure  that 
vessel  crews  are  prepared  to  respond  to  potential  scenarios 
in  the  event  of  an  emergency  and  know  their  roles,  should 
the  need  for  action  arise. 

Vessel  Operations 

The  goal  of  the  safety  management  system  is  to  ensure  the 
vessel  is  operated  in  a  way  that  takes  the  crew's  as  well  as 
the  environment's  safety  into  account.  Vessel  owners  can 
ensure  the  ship  is  operating  in  the  safest,  most  efficient 
means  possible  by  following  the  procedures  for  conducting 
vessel  daily  operations  clearly  laid  out  in  the  SMS. 

It  is  imperative  that  the  vessel  master  ensures  these  pro¬ 
cedures  are  followed.  When  the  ISM  Code  was  first  imple¬ 
mented,  there  were  many  off-the-shelf  safety  management 
systems  that  did  not  accurately  describe  what  was  actually 
being  done  in  practice.  If  the  SMS  isn't  practical  or  doesn't 
reflect  current  onboard  operations  for  that  specific  vessel, 
the  master  should  work  with  the  company  to  address  the 
deficiency  and  make  corrections  to  the  SMS  as  necessary. 
The  safety  management  system  is  then  a  living  document 


The  author,  LCDR  Demo  (right),  discusses  vessel  operations  with  the 
vessel  master.  U.S.  Coast  Guard  photo  by  LCDR  Lee  Bacon. 


specifically  made  for  the  individual  vessel  the  system 
supports. 

Additionally,  the  safety  management  system  only  works  if 
the  company  and  the  vessel's  master  actively  use  it.  If  crews 
conduct  operations  outside  of  the  SMS  and  not  as  per  the 
approved  plan,  then  the  safety  management  system  will 
fail,  which  could  result  in  a  marine  casualty.  Similarly,  if 
shoreside  personnel  don't  provide  sufficient  resources  for 
the  crew  to  perform  needed  maintenance,  then  safety  will 
degrade. 

Further,  process  effectiveness  must  constantly  be  evalu¬ 
ated,  as  maintenance  levels  that  worked  well  when  the  ship 
was  10  years  old  might  barely  be  adequate  when  the  ship 
turns  20.  Constant  evaluation  and  corrective  action  ensures 
that  processes  are  effective  for  each  specific  ship  and  its 
operations. 

Achieving  regulatory  compliance  goals  in  a  consistent, 
sustained  manner  is  a  hallmark  of  an  effective  SMS,  as  the 
goal  of  the  safety  management  system  is  to  be  out  ahead  of 
problems  rather  than  waiting  and  only  providing  correction 
when  failures  occur. 
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The  author,  LCDR  Demo  (right),  discusses  a  liquefied  natural  gas  fuel 
system.  U.S.  Coast  Guard  photo  by  LCDR  Lee  Bacon. 


ISM  Code  Certification  Delegation 

Like  many  flag  administrations,  the  United  States  elected 
to  delegate  authority  to  recognized  organizations  (ROs)  to 
conduct  ISM  audits  and  issue  ISM  certificates  on  behalf  of 
the  Coast  Guard.  All  of  the  recognized  organizations  del¬ 
egated  ISM  authorization  are  also  Coast  Guard-recognized 
classification  societies.  ROs  for  ISM  Code  certification  cur¬ 
rently  include: 

•  ABS, 

•  DNV-GL, 

•  RINA,  and 

•  Class  NK. 

It  is  not  required  that  a  U.S.-flagged  vessel  use  the  same  rec¬ 
ognized  organization  for  ISM  as  they  do  for  classification, 
and  some  companies  have  expressly  elected  to  use  a  recog¬ 
nized  organization  separate  from  their  ship's  classification 
society  to  gain  an  independent  evaluation  of  their  company 
and  vessel  operations. 

This  is  a  well-intentioned  motive,  but  vessel  owners  need  to 
be  aware  that  it  reduces  the  free  flow  of  information  between 


those  who  survey  the  ship  and  those  who  audit  the  SMS.  In 
cases  where  two  separate  ROs  are  employed  for  a  vessel 
or  company,  the  Coast  Guard  and  the  owner  must  ensure 
that  the  surveyor  and  auditor  enjoy  unrestricted  access  to 
relevant  information. 

In  the  mid-1990s,  the  audit  and  survey  were  viewed  as 
wholly  separate,  unconnected  activities.  With  the  passage 
of  time,  however,  the  Coast  Guard  and  their  recognized 
organizations  have  come  to  realize  that  good  SMS  process 
control  leads  to  good  conditions  throughout  the  survey 
through  factors  such  as  preventative  maintenance  planning. 

Recognizing  that  communication  between  auditors  and 
surveyors  is  critical,  the  International  Association  of  Clas¬ 
sification  Societies  implemented  Procedural  Requirement  17 
(PR  17)  to  allow  surveyors  to  note  conditions  indicative  of 
poor  safety  management  and  pass  that  information  along 
either  internally  to  their  own  class  society  ISM  depart¬ 
ment  or  externally  to  the  RO  providing  ISM  certification. 
By  agreement  with  our  recognized  organizations,  the  Coast 
Guard  receives  notice  of  all  PR  17s  issued  to  U.S.-flagged  ves¬ 
sels,  whereupon  we  fully  engage  with  the  RO  to  investigate. 

Likewise,  the  Coast  Guard  is  notified  if  a  major  noncon¬ 
formity  is  noted  during  an  audit  of  a  U.S.-flagged  vessel. 
Coast  Guard  and  RO  personnel  then  discuss  downgrading 
a  major  nonconformity  to  nonconformances  if  the  company 
initiates  a  root  cause  analysis  as  well  as  a  corrective  action 
plan.  Otherwise,  a  major  nonconformity  is  reason  for  the 
Coast  Guard  to  suspend  or  revoke  the  ISM  certificate.  Where 
a  major  nonconformity  has  been  downgraded.  Coast  Guard 
and  recognized  organization  personnel  evaluate  whether  or 
not  the  corrective  action  has  been  fully  implemented. 

When  the  RO  conducts  a  follow-up  audit  within  90  days 
of  the  major  nonconformity,  in  most  instances,  the  Coast 
Guard  will  assign  a  marine  inspector  to  attend  the  follow-up 
audit.  The  marine  inspector  and  the  RO  personnel  will  then 
evaluate  if  the  corrective  action  for  the  major  nonconformity 
is  sufficient. 

Coast  Guard  stewardship  over  its  recognized  organization 
delegation  for  ISM  Code  is  essential  for  full  and  effective 
implementation  of  the  ISM  Code  on  U.S.-flagged  vessels. 

About  the  author: 

LCDR  Aaron  Demo  is  a  graduate  of  Massachusetts  Maritime  Academy  and 
has  served  in  the  U.S.  Coast  Guard  for  15  years.  He  has  also  served  as  chief 
of  the  Inspections  Division  at  Sector  Houston-Galveston,  assistant  chief  of 
the  Domestic  Vessel  Branch  at  Sector  Hampton  Roads,  and  chief  of  the  Inci¬ 
dent  Management  Division  at  Sector  New  Orleans.  Additionally,  LCDR 
Demo  holds  a  license  as  a  1600-ton  Master  Upon  Oceans,  Master  of  Towing 
Vessels  Upon  Oceans,  and  a  Third  Mate  Unlimited  Upon  Oceans. 
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Safety  Management  Systems 
to  Prevent  Pollution  from  Ships 

Standard  procedures  protect  the  environment. 

by  LCDR  Michael  Lendvay 
Office  of  Commercial  Vessel  Compliance 
U.S.  Coast  Guard 


The  U.S.  receives  approximately  9,000  foreign  commercial 
ships  per  year  that  make  more  than  75,000  port  calls. 1  These 
vessels  on  international  voyages  include  container  vessels, 
passenger  vessels,  and  tank  vessels,  among  other  types.  As 
a  result,  they  must  comply  with  a  variety  of  international 
requirements,  including  the  Safety  of  Life  at  Sea  (SOLAS), 
the  International  Convention  for  the  Prevention  of  Pollution 
from  Ships  (MARPOL). 

A  safety  management  system  (SMS)  is  required  under 
SOLAS,  and  sections  of  MARPOL  require  written  proce¬ 
dures  for  garbage  management,  fuel  switchover,  and  cargo 
transfers.  Also,  as  part  of  the  International  Safety  Manage¬ 
ment  Code,  every  company  must  develop  and  implement 
a  safety  management  system,  which  includes  a  safety  and 
environmental  policy  as  well  as  reporting  requirements, 
authorities,  communication  channels,  and  audit  procedures. 
Additionally,  U.S.  Coast  Guard  regulations  require  written 
fuel  oil  and/or  cargo  transfer  procedures. 

A  good  SMS  contributes  to  ship  and  crew  safety  and  helps 
ensure  the  ship  is  prepared  to  manage  its  environmental 
responsibilities,  potentially  reducing  waste  streams  and  the 
costs  associated  with  waste  disposal. 

Waste  Streams 

Waste  products  on  a  ship  must  be  properly  processed 
onboard  or  sent  to  shore  for  processing  and/or  disposal.  An 
efficient  SMS  addresses  waste  stream  reduction  and  iden¬ 
tifies  proper  processing  and  waste  disposal  methods.  For 
example,  a  quality  safety  management  system  addresses 
proper  machinery  maintenance  and  repair  to  help  engineers 
eliminate  or  at  least  minimize  oil  and  fuel  leaks  that  often 
mix  with  water  in  the  bilge  or  leak  out  of  equipment  on 


deck.  This  oily  water  mixture  often  results  in  heavier  waste 
streams  that  may  decrease  overall  efficiency  and  cause 
greater  problems  down  the  line. 

The  oil  filtering  discharge  equipment  onboard  a  ship, 
known  as  the  oily  water  separator  (OWS),  processes  lightly 
oiled  water  much  more  efficiently  than  heavy  mixtures. 
Heavy  mixtures  require  longer  processing  periods,  which 
cause  machinery  to  run  longer  and  require  additional 
servicing  and  cleaning  —  sometimes  rendering  the  OWS 
unserviceable. 

Garbage  Management 

Ships  prevent  pollution  at  sea  by  properly  separating  gar¬ 
bage  and  knowing  when,  where,  and  how  to  properly 
marshal  and  document  garbage  disposal.  Implementing  a 


SMS  Failure 

The  U.S.  Coast  Guard  recently  detained  a  vessel 
caught  bypassing  the  oily  water  separator.  In  this  case, 
crewmembers  reported  to  Coast  Guard  personnel  that 
some  of  the  engineers  ordered  them  to  pump  waste  oily 
bilge  water  directly  overboard  through  the  marine  sanita¬ 
tion  device.  This  was  counter  to  the  vessel's  safety  manage¬ 
ment  system  and  violated  international  regulations,  as  well. 

When  Coast  Guard  personnel  conducted  a  port  state 
control  exam  of  the  vessel,  they  found  multiple  groundsfor 
detainment:  oily  residue  in  the  marine  sanitation  device, 
discrepancies  noted  in  the  required  oil  record  book,  and 
oily  waste  water  stored  in  unapproved  tanks. 
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Detentions 

Last  year  the  U.S.  Coast  Guard  issued  143  International 
Maritime  Organization  detentions.1  The  top  three  areas  for 
detainable  deficiencies  were: 

•  International  Safety  Management  (ISM)  Code  deficien¬ 
cies, 

•  International  Convention  for  the  Prevention  of  Pollu¬ 
tion  from  Ships  (MARPOL)  Annex  I  violations,  and 

•  firefighting  appliance  deficiencies. 

Of  these  detentions,  21  percent  involved  safety  manage¬ 
ment,  17  percent  were  for  MARPOL  issues,  and  17  percent 
were  in  regards  to  firefighting  appliance  deficiencies. 

In  most  cases  with  ISM,  it  was  clear  that  the  master  and  crew 
were  either  not  familiar  with  ISM  requirements  or  failed 
altogether  to  properly  conduct  required  ship  equipment 
maintenance  in  accordance  with  their  safety  management 
system  procedures. 

With  regard  to  MARPOL  deficiencies,  we  continue  to  find 
vessel  crews  who  attempt  to  bypass  their  oily  water  sepa¬ 
rators  and  discharge  oily  waste  directly  overboard.  Other 
crews  failed  to  conduct  proper  maintenance  or  didn't  know 
how  to  operate  equipment  properly. 

Firefighting  deficiencies  can  be  caused  by  poor  equip¬ 
ment  and  also  by  not  following  safety  management 
system  procedures.  One  example  we  see  too  frequently  is 
the  intentional  disabling  of  automatic  water-based  fixed 
firefighting  systems. 

Endnote: 

1  U.S.  Coast  Guard  Port  State  Control  Annual  Report  2014. 


good  SMS  that  requires  training  and  familiarization  in  these 
areas  increases  overall  efficiency  by  greatly  reducing  the 
ship's  environmental  pollution  potential  and  reducing  costs 
associated  with  paying  for  unnecessary  waste  disposal. 

This  is  particularly  important  due  to  the  limited  space 
onboard  vessels  and  the  need  to  retain  much  of  the  gar¬ 
bage.  Under  MARPOL  Annex  V,  Prevention  of  Pollution  by 


Garbage  from  Ships,  plastics  may  never  be  discarded  over¬ 
board,  and  in  special  areas  such  as  the  Western  Caribbean 
and  Gulf  of  Mexico,  very  little  other  than  food  waste  may 
be  disposed  of  at  sea. 

Without  a  good  safety  management  system  and  manage¬ 
ment  plan,  vessel  operators  face  the  possibility  of  fines  or 
detention.  However,  with  a  good  SMS  with  logs  and  proper 
documentation,  port  state  control  officers,  ship  manage¬ 
ment,  and  persons  on  shore  can  quickly  determine  compli¬ 
ance  and  ensure  that  illegal  waste  does  not  end  up  in  the  sea. 

New  Fuel  Requirements 

New  requirements  under  MARPOL  Annex  VI,  Prevention 
of  Air  Pollution  from  Ships,  have  gone  into  effect,  lowering 
the  allowed  content  of  sulfur  in  fuel  oil  in  the  North  Ameri¬ 
can  emission  control  area  from  1  percent  to  0.10  percent. 
While  this  new  requirement  will  help  improve  air  quality, 
particularly  in  areas  along  the  coast,  it  has  prompted  addi¬ 
tional  areas  of  concern  resulting  from  ship  owners  changing 
fuels  and/or  installing  systems  such  as  exhaust  gas  scrub¬ 
bers  to  remove  sulfur. 

Changing  fuels  can  cause  problems  if  not  done  correctly. 
The  compliant  fuel  burns  at  a  lower  temperature  and  differ¬ 
ent  pressure  than  heavy  fuel  oil.  Following  the  changeover, 
some  vessels  experienced  leaks,  requiring  the  crew  to  either 
switch  back  to  the  heavy  fuel  oil  or  make  repairs  and  modi¬ 
fications  to  the  fuel  system's  piping.  Vessel  operators  can 
avoid  such  issues  and  better  comply  with  new  requirements 
without  incident  by  properly  implementing  pre-established 
changeover  procedures. 

When  adding  new  technology,  such  as  exhaust  gas  scrub¬ 
bers,  operators  should  concurrently  realize  the  need  for 
additional  safety  management  system  procedures  to  prop¬ 
erly  operate,  maintain,  and  report  any  system  nonconfor¬ 
mities.  As  new  technology  and  systems  are  incorporated, 
vessel  operators  must  update  their  procedures  to  address 
such  developments. 

About  the  author: 

LCDR  Lendvay  has  served  in  the  Coast  Guard  for  17  years  as  a  marine 
inspector  and  marine  investigator.  He  is  currently  the  port  state  control  com¬ 
pliance  manager  in  the  Office  of  Vessel  Compliance  and  has  spent  much  of 
his  career  ensuring  compliance  with  environmental  laws  and  treaties. 

Endnote: 

1-  U.S.  Coast  Guard  Port  State  Control  Annual  Report  2014. 
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Dead  Reckoning 
by  Safety  Management? 

Check  your  course. 


by  LCDR  Corydon  F.  Heard  IV 
Prevention  Department  Head 
Marine  Safety  Unit  Texas  City 
U.S.  Coast  Guard 


On  the  evening  of  March  6, 1987,  in  the  early  moments  of  the 
passage  from  Zeebrugge,  Belgium,  to  Dover,  U.K.,  the  roll- 
on/roll-off  passenger/freight  ferry  Herald  of  Free  Enterprise 
capsized  while  transporting  80  crewmembers  and  459  pas¬ 
sengers.  Of  those  aboard,  193  perished. 

In  the  immediate  aftermath  of  the  disaster,  investigators 
determined  that  the  main  causal  factor  was  failure  to  secure 
the  inner  and  outer  bow  doors.  As  the  case  progressed,  the 
formal  investigation  also  identified  several  root  causes 
within  the  corporate  structure  of  the  shore  management 
that  contributed  to  the  disaster. 

For  example,  the  formal  investigation  specifically  cited  the 
shore  management  for  failing  to  give  proper  and  clear  direc¬ 
tions.  These  findings  led  the  court  to  propose  the  safety 
management  principles  that  eventually  resulted  in  the  Inter¬ 
national  Safety  Management  (ISM)  Code. 

It's  been  more  than  two  decades  since  ISM  Code  inception, 
and  yet,  as  a  recent  Coast  Guard  enquiry  concluded,  the 
management  practices  that  contributed  to  the  Herald  of  Free 
Enterprise  tragedy  remain  (see  "Noncompliance"  sidebar). 

This  is  not  to  suggest  that  the  design  of  the  ISM  Code  itself 
is  fundamentally  flawed  so  much  as,  when  compared  to 
clearly  prescriptive  regulations,  its  orientation  as  a  man¬ 
agement  system  leaves  it  open  to  various  interpretations. 
It  is  this  degree  of  subjectivity  that  can  complicate  effec¬ 
tive  safety  management  system  (SMS)  implementation  and 
challenge  ISM  Code  administration.  Therefore,  to  counter¬ 
balance  this  ambiguity,  a  clearer  understanding  of  safety 
management  system  fundamentals  is  required. 


A  Functional  System 

By  design,  a  safety  management  system  is  an  integrated  com¬ 
pilation  of  policies,  procedures,  and  behaviors  structured  to 
ensure  a  formalized,  proactive  approach  to  safety  manage¬ 
ment.  Conceptually,  and  comparable  to  quality  management 
systems,  the  role  of  leadership  and  organizational  culture 
are  paramount  in  ensuring  that  safety  policies,  rules,  and 
processes  are  effectively  implemented,  reviewed,  and  con¬ 
tinuously  improved. 

Over  time,  this  methodology  has  matured  and  transcended 
industries  such  as  civil  aviation,  rail  transit,  food  safety,  and 
health  care.  In  the  commercial  maritime  domain,  compliance 
comes  by  way  of  an  international  mandate  under  Chapter  IX 
of  the  International  Convention  for  the  Safety  of  Life  at  Sea 
(SOLAS)  and  the  ISM  Code,  requiring  shipping  companies 
to  each  establish  a  management  system  to  ensure  that  com¬ 
mercial  vessels  are  maintained  and  operated  safely,  prevent 
maritime  accidents,  and  protect  the  marine  environment. 

The  guiding  principles  for  a  functional  SMS  can  be  sum¬ 
marized  in  three  basic  tenets: 

•  Say  what  you  do. 

•  Do  what  you  say  you  do. 

•  Prove  that  you  do  what  you  say  you  do. 1 


A  safety  management  system  is  a 
compilation  of  policies,  procedures, 
and  behaviors  structured  to  ensure 
a  formalized,  proactive  approach  to 
safety  management. 
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the  maritime  company  must  ensure  that  the  marine 
crew  can  rely  on  the  functional  process  with  full 
support  from  shore  management.  Likewise,  shore 
management  must  depend  upon  the  marine  crew  to 
employ  the  system  to  its  full  potential,  setting  forth 
the  common  goal  of  continual  improvement. 

Implementation 

Despite  the  fundamental  principles  of  the  SMS 
methodology  and  regardless  of  the  industry  or 
mandate,  all  hinge  on  a  single  common  prem¬ 
ise — the  management  system  is  only  as  effective  as 
its  implementation.  Implemented  properly,  a  safety 
management  system  forms  the  functional  frame¬ 
work  for  a  comprehensive  business  management 
system  designed  to  manage  safety  elements  in  the 
workplace. 

In  practice,  an  operational  safety  management  sys¬ 
tem  is  the  manifestation  of  the  "prevention  through 
people"  ideology.  However,  if  dismissed  as  a  trivial 
requirement  for  certification,  the  SMS  risks  becom¬ 
ing  just  another  catchphrase  in  the  nautical  lexicon, 
and  such  lack  of  effective  implementation  risks  a 
substandard  or  materially  unsafe  condition. 

Continuous  Improvement 

Safety  assurance  builds  on  the  principle  of  continu¬ 
ous  improvement  by  identifying  and  eliminating 
the  root  causes  of  substandard  conditions.  Com¬ 
panies  can  achieve  this  objective  through  ongoing 
operational  SMS  evaluations  via  internal  company 
audits,  management/master's  reviews,  external 
verifications,  and  operational  safety  and  corrective 
action  monitoring. 


This  is  simple  enough,  theoretically.  Establishing  manage¬ 
ment  procedures  and  policies  (say  what  you  do)  ensures  that 
conditions,  activities,  and  tasks  affecting  safety  and  envi¬ 
ronmental  protection  —  ashore  and  aboard  vessels  —  are 
planned,  organized,  executed,  and  checked  in  accordance 
with  regulatory  and  company  requirements.  For  many  com¬ 
panies,  this  means  formalizing  long-established  processes 
and  placing  the  associated  documents  under  a  greater 
degree  of  control.  For  others,  establishing  an  effective  SMS 
is  a  more  comprehensive  process. 

Conversely,  putting  the  SMS  into  operation  presents  a 
dynamic  challenge.  Actually  doing  what  you  say  you  do 
requires  an  unconditional  and  unwavering  investment  from 
all  levels  of  the  organization,  starting  with  the  upper  eche¬ 
lon  of  shore  management  and  filtering  down  to  the  rank  and 
file.  For  the  safety  management  system  to  work  as  intended. 


The  guiding  principles  for  a  functional 
SMS: 

•  Say  what  you  do. 

•  Do  what  you  say  you  do. 

•  Prove  that  you  do  what  you  say  you  do. 

If  the  corrective  action  doesn't  adequately  address  the  actual 
root  cause  or  underlying  condition,  then  it  will  never  be 
truly  effective.  In  fact,  it  could  be  indicative  of  a  flawed  or 
ineffective  system.  In  such  cases,  a  flawed  corrective  action 
cycle  is  the  navigational  equivalent  of  dead  reckoning.2 
Under  this  paradigm,  as  each  estimate  of  position  is  relative 
to  the  previous  one,  errors  are  cumulative  or  compounding. 
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After  all,  a  key  indicator  of  a  functioning  SMS  is  not  the 
absence  of  nonconformities,  but  rather  a  clear  indication  that 
when  a  nonconformance  is  identified,  it  is  reported  in  accor¬ 
dance  with  the  established  procedure,  analyzed,  and  that 
corrective  action  is  undertaken  in  a  timely  manner  ( prove 
that  you  do  what  you  say  you  do).  This  is  the  premise  for  effec¬ 
tive  continuous  improvement. 

Compliance 

Today,  compliance  with  the  International  Safety  Manage¬ 
ment  Code  is  associated  with  nearly  every  other  aspect  of 
overall  regulatory  compliance.  The  Coast  Guard's  oversight 
of  the  ISM  Code  is  an  element  of  safety  assurance  verifica¬ 
tion  that  occurs  constantly  as  a  part  of  many  routine  activi¬ 
ties.  Coast  Guard  personnel  perform  this  oversight  as  the 
flag  administration  for  U.S.  vessels  as  well  as  under  the  Port 
State  Control  program  for  foreign  vessels  subject  to  U.S. 
jurisdiction.  Examining  a  vessel  for  any  purpose  provides 
an  opportunity  to  evaluate  safety  management  system  effec¬ 
tiveness.  To  leverage  the  maximum  benefit  of  this  approach, 
the  Coast  Guard  has  undertaken  a  review  of  existing  code 
oversight  policies  with  a  view  to  rebooting  the  guidance  to 
better  focus  field  resources.3 


The  management  system  is  only  as 
effective  as  its  implementation. 


Vessel  inspections  and  examinations  provide  a  means  of 
evaluating  International  Safety  Management  Code  compli¬ 
ance,  the  most  basic  of  which  is  verification  that  the  vessel 
and  company  have  valid  ISM  Code  certification.  The  next 
step  is  to  identify  links  between  any  deficiencies  or  casual¬ 
ties  noted  during  the  course  of  routine  inspections /investi¬ 
gations  and  the  vessel's  SMS.  This  requires  marine  inspec¬ 
tors,  port  state  control  officers,  and  marine  investigators  to 
have  a  working  knowledge  of  the  ISM  Code's  key  elements 
and  the  duties  and  training  of  shipboard  personnel. 

Although  ISM  Code  oversight  may  not  be  the  primary  pur¬ 
pose  of  an  examination,  inspectors  remain  cognizant  of  the 
important  role  a  safety  management  system  has  in  miti¬ 
gating  deficiencies  and  preventing  casualties.  To  this  end, 
when  conducting  an  inspection  for  purposes  other  than 
verifying  compliance  with  the  code,  the  inspector  may  note 
any  deficiencies  that  most  likely  could  have  been  discov¬ 
ered  and  managed  if  the  SMS  had  been  thoroughly  applied. 
Oversight  may  also  arise  from  investigations  into  vessel 
casualties  and  vessel  crewmembers'  reports. 

As  a  flag  administration,  we  focus  on  improving  methods 
to  identify  poor-quality  vessels  to  eliminate  substandard 


Noncompliance 

Although  safety  management  system  indifference  is 
generally  the  exception  and  not  the  rule,  it  is  an  unfor¬ 
tunate  reality,  nonetheless.  That's  why  the  Coast  Guard 
initiated  a  campaign  in  2011  focused  on  holding  repeat 
offenders  accountable  by  targeting  the  company  SMS 
for  increased  oversight  and  compliance  verification  at 
the  management  level. 

In  a  precedent-setting  case,  objective  evidence  of 
continued  noncompliance  with  the  requirements  of 
the  ISM  Code,  applicable  international  conventions, 
and  flag  state  regulations — as  well  as  a  systemic  failure 
to  adequately  implement  company  policies  and  proce¬ 
dures  — led  to  the  first-ever  revocation  and  cancellation 
of  a  U.S.  company's  ISM  document  of  compliance  (DOC) 
for  cause. 

A  review  of  attendance  reports  that  various  authori¬ 
ties,  including  port  state  control  and  the  Coast  Guard, 
documented  clearly  established  a  pattern  of  habitual 
disregard  for  rules  and  regulations.  The  company  also 
repeatedly  failed  to  implement  effective  corrective 
action,  which  was  indicative  of  an  ineffective  SMS. 
Indeed,  the  company's  DOC  was  on  the  third  short¬ 
term  issuance  because  of  an  ineffective  response  to 
externally  raised  nonconformances.  As  a  result,  the 
company's  international  fleet  was  essentially  grounded 
due  to  the  invalidation  of  required  convention  trading 
certificates  (safety  management  certificates). 


shipping.  This  means  we  take  a  more  proactive  role  in 
administrating  the  activities  of  recognized  organizations, 
overseeing  auditing  and  verification  processes,  and  con¬ 
ducting  trend  analyses  of  possible  SMS  failures  and  major 
nonconformities  on  U.S.  vessels.  By  monitoring  potential 
failures  and  major  nonconformities  from  a  central  view,  the 
Coast  Guard  has  been  better  able  to  identify  trends  indicat¬ 
ing  a  systemic  SMS  issue  across  a  common  fleet  manage¬ 
ment.  Once  the  trends  are  identified,  the  Coast  Guard  can 
direct  appropriate  resources  for  focused  oversight. 


A  key  indicator  of  a  functioning  SMS 
is  not  the  absence  of  nonconformities, 
but  rather  when  a  nonconformance  is 
identified,  it  is  reported  and  corrective 
action  is  taken. 
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The  View  From  the  Bow 

Though  it  occurred  almost  30  years  ago,  the  Herald  of  Free 
Enterprise  disaster  remains  a  stark  reminder  of  the  conse¬ 
quences  of  untenable  safety  management  practices.  One 
goal  of  the  International  Safety  Management  Code  is  to 
establish  a  process  of  continuous  communication,  training, 
and  actions  that  constantly  maintain  the  vessel  in  a  state  of 
full  compliance  with  safety  and  environmental  protection 
regulations.  This  includes  the  processes  and  procedures  for 
reporting  accidents  and  nonconformities. 

The  ISM  Code  doesn't  necessarily  prescribe  a  manner  in 
which  this  must  be  done.  Rather,  it  allows  companies  to 
define  their  own  ways  of  reaching  that  goal,  taking  into 
account  the  prescribed  functional  requirements  for  a  safety 
management  system.  There  is  no  one  correct  way  to  do  this 
because  an  effective  SMS  is  tailor-made  to  fit  an  individual 
company's  culture,  organization,  service,  and  work  environ¬ 
ment.  What  may  work  for  one  company  may  not  work  for 
another. 

Inspectors  and  auditors  must  therefore  be  vigilant  to  ensure 
companies  have  an  effective  safety  management  system  that 
meets  ISM  Code  objectives.  An  empty-husk  SMS  that  only 
exists  to  satisfy  what  is  viewed  as  "just  another  regulation" 
meets  neither  the  spirit  nor  the  intent  of  the  code.  A  good 
measure  of  an  effective  SMS  is  one  that  allows  users  to  iden¬ 
tify,  report,  investigate,  correct,  and  appropriately  docu¬ 
ment  nonconformities  in  accordance  with  the  established 
procedure. 


Inspectors  and  auditors  ensure 
companies  have  an  effective  safety 
management  system  that  meets  ISM 
Code  objectives. 


A  company's  success  level  putting  its  SMS  into  operation  is 
directly  related  to  the  organization's  commitment  to  achiev¬ 
ing  those  goals  amidst  all  the  other  priorities  competing 
for  attention.  Hence,  strict  discipline  and  a  commitment  to 
safety  objectives  starts  at  the  senior  management  level.  This 
requires  a  firm  management  and  command  structure  with 
clear  and  concise  orders.  Leaders  must  pay  attention  to  all 
matters  affecting  the  safety  of  the  vessel  and  those  aboard 
and  must  regularly  review  performance  against  the  organi¬ 
zation's  safety  objectives. 

While  managers  demonstrate  commitment  through  their 
actions  and  involvement,  all  employees  and  crewmembers 
need  to  follow  suit  for  the  system  to  be  fully  functional  and 
integrated.  Accordingly,  all  employees  and  crewmembers 
should  be  aware  of  the  influence  their  actions  or  inactions 
may  have  on  SMS  effectiveness.  An  effective  safety  manage¬ 
ment  system  starts  with  you — at  the  end  of  the  watch,  it's 
your  vessel,  your  life,  and  your  responsibility. 

About  the  author: 

LCDR  Corydon  Heard  is  the  Prevention  Department  head  at  Marine  Safety 
Unit  Texas  City.  Prior  tours  include  the  U.S.  Coast  Guard  Office  of  Com¬ 
mercial  Vessel  Compliance,  Sector  Baltimore,  and  Activities  Europe.  He  is 
a  graduate  of  the  U.S.  Merchant  Marine  Academy  and  has  also  earned  an 
M.A.  and  a  doctorate  in  business  administration.  He  also  holds  an  unlimited 
U.S.  merchant  marine  officer  endorsement. 

Bibliography: 

https://assets.digital.cabinet-office.gov.uk/media/54cl704ce5274al5b6000025/For- 

malInvestigation_HeraldofFreeEnterprise-MSA1894.pdf. 

Safe  Work  Australia,  Guide  for  Major  Hazard  Facilities:  Safety  Management  Sys¬ 
tems. 

Endnotes: 

1-  Marine  Safety  Manual  Volume  II,  Section  E,  Chapter  3. 

2-  Dead  reckoning  is  the  process  of  calculating  current  position  by  using  a  previously 
determined  position,  or  fix,  and  advancing  that  position  based  upon  estimated 
speeds  over  elapsed  time  and  course.  The  resulting  position  is  only  an  approxima¬ 
tion,  as  it  does  not  allow  for  the  effect  of  significant  errors. 

3-  This  philosophy  is  maintained  in  Marine  Safety  Manual  Volume  II,  Section  E, 
Chapter  3.  Key  elements  of  this  approach  have  been  excerpted  here. 
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Mitigating  Risks  on  the 
Outer  Continental  Shelf 

Safety  and  environmental 
management  systems  in  action. 


by  LT  Jason  Kling 

Office  of  Design  and  Engineering  Standards 
Human  Element  and  Ship  Design  Division 
U.S.  Coast  Guard 


The  outer  continental  shelf  (OCS)  is  one  of  the  riskiest  oper¬ 
ating  environments  the  U.S.  Coast  Guard  regulates.  Under 
the  Outer  Continental  Shelf  Lands  Act,  Coast  Guard  respon¬ 
sibilities  include  developing  and  implementing  regulations 
to  protect  the  safety  of  life,  property,  and  the  environment 
on  outer  continental  shelf  installations,  vessels,  and  units 
engaged  in  OCS  activities. 

One  of  the  most  effective  ways  to  mitigate  safety  and  envi¬ 
ronmental  risk  on  the  OCS  involves  using  safety  and  envi¬ 
ronmental  management  systems,  often  referred  to  as  SEMS,1 
which  provide  a  framework  for  using  policies  and  proce¬ 
dures  to  adequately  manage  the  risk  associated  with  an  off¬ 
shore  vessel  or  facility  operation. 

Like  Nowhere  Else 

The  OCS  is  a  unique  regulatory  environment.  It  consists  of 
oil  and  gas  operators  that  the  Bureau  of  Safety  and  Envi¬ 
ronmental  Enforcement  (BSEE)  regulates,  pipeline  opera¬ 
tors  who  answer  to  the  Pipeline  and  Hazard¬ 
ous  Material  Safety  Administration  (PHMSA), 
contractors  who  aren't  directly  regulated,  and 
vessel  and  facility  operators  the  Coast  Guard 
regulates. 

Oil  and  gas  operators,  also  known  as  leasehold¬ 
ers,  are  in  the  business  of  exploring  for,  devel¬ 
oping,  and  producing  minerals  on  the  outer 
continental  shelf.  These  companies  typically 
operate  production  facilities  that  may  be  fixed 
or  floating  platforms.  While  the  leaseholders 
are  physically  present  and  responsible,  they 
normally  hire  drilling  contractors  who  operate 
mobile  offshore  drilling  units  (MODUs).  OCS 
oil  and  gas  operators  must  maintain  safety  and 


environmental  management  systems  to  manage  the  risks 
associated  with  these  operations. 

Regulatory  Challenges 

The  BSEE  regulations  in  Title  30  Code  of  Federal  Regula¬ 
tions,  Part  250,  Subpart  S,  incorporate  the  American  Petro¬ 
leum  Institute  Recommended  Practice  75  for  developing, 
implementing,  and  maintaining  safety  and  environmen¬ 
tal  management  systems.  BSEE  supplements  this  recom¬ 
mended  practice  with  additional  SEMS  program  features 
and  an  audit  protocol  with  agency  oversight.  The  BSEE 
SEMS  rule  was  published  in  2010,2  updated  in  2013,3  and 
has  been  an  effective  tool  used  by  oil  and  gas  operators  to 
manage  risks  and  coordinate  with  contractors. 

Pipeline  operators  transport  oil  and  gas  to  onshore  facili¬ 
ties  and  install  and  maintain  subsea  pipelines  that  make  up 
the  complex  network  that  runs  under  the  Gulf  of  Mexico. 
The  pipelines  connect  BSEE-regulated  offshore  facilities  to 


PIPELINES  (line) 


The  Gulf  of  Mexico  outer  continental  shelf  pipeline  network.  Photo  courtesy  of  the  U.S. 
Department  of  Interior,  Bureau  of  Ocean  Energy  Management. 
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View  of  a  floating  offshore  installation  from  a  vessel  at  the  500-meter  zone 
boundary.  U.S.  Coast  Guard  photo  by  LT  Jason  Kling. 


onshore  facilities  that  may  be  Coast  Guard-regulated,  so 
the  operators  have  a  variety  of  interfaces  that  each  present  a 
certain  degree  of  risk.  Additionally,  pipeline  operators  sig¬ 
nificantly  contribute  to  the  OCS  risk  profile  that  correlates 
to  the  amount  of  pipeline  mileage  spanning  the  seabed.  The 
Pipeline  and  Hazardous  Material  Safety  Administration 
is  developing  a  national  consensus  standard  for  pipeline 
safety  and  environmental  management  systems.  By  adopt¬ 
ing  the  API  Recommended  Practice  1173,  PHMSA  plans  to 
provide  its  operators  with  the  framework  needed  to  manage 
the  risks  inherent  in  large-scale  oil  and  gas  transportation. 

Vessel  operators  provide  mobile  capabilities  for  the  above- 
mentioned  operators,  and  are  contracted  to  carry  out  a  vari¬ 
ety  of  outer  continental  shelf  activities.  Vessels  are  typically 
involved  in  offshore  facility  construction,  while  MODUs 
perform  drilling  activities.  Vessels  also  provide  support 
services  for  facilities  engaged  in  exploration  or  production 
processes.  This  extensive  support  of  offshore  infrastructure 
increases  vessel  OCS  exposure,  which  increases  the  risk 
from  offshore  activities. 

Safety  Management  Systems 

While  the  Coast  Guard  does  not  have  safety  management 
regulations  specific  to  vessels  engaged  in  OCS  activities,  it 
does  require  safety  management  systems  on  certain  vessels 
engaged  on  a  foreign  voyage.  Title  33  CFR  Part  96  contains 
these  regulations  that  generally  apply  to  a  foreign  voyage 
vessel  that: 

•  transports  more  than  12  passengers; 

•  is  a  tanker,  bulk  freight  vessel,  freight  vessel,  or  self- 
propelled  mobile  offshore  drilling  unit  of  500  gross  tons 
or  more;  or 


•  is  a  foreign  vessel  bound  for  ports  or  places  under  the 
jurisdiction  of  the  United  States  and  subject  to  Chap¬ 
ter  IX  of  the  International  Convention  for  the  Safety  of 
Life  at  Sea  (SOLAS). 

While  this  regulation  may  apply  to  vessels  engaged  in  OCS 
activities,  many  vessels  in  dedicated  offshore  service  do 
not  operate  under  a  regulated  SMS  or  SEMS.  In  2013,  the 
Coast  Guard  published  an  Advance  Notice  of  Proposed 
Rulemaking  to  communicate  the  agency's  intentions  to 
require  SEMS  on  vessels  engaged  in  OCS  activities.4  The 
rulemaking  project  is  currently  under  development  to 
evaluate  the  need  for  additional  safety  and  environmental 
management  system  requirements  for  OCS  vessel  operators. 

Bridging  the  Gap 

While  leaseholders,  pipeline  operators,  and  vessel  opera¬ 
tors  perform  routine  activities  associated  with  their  facili¬ 
ties,  they  may  also  rely  on  offshore  service  contractors  to 
carry  out  specialized  activities.  This  additional  group  is  not 
directly  regulated,  but  is  usually  involved  with  many  of 
the  activities  associated  with  exploration  and  production 
processes. 

Placing  all  of  these  parties  on  the  outer  continental  shelf 
makes  for  a  complicated  interface.  To  better  manage  com¬ 
munications  and  risk,  the  oil  and  gas  operators  exercise  a 
bridging  process  to  align  safety  policies  and  procedures. 
Since  leaseholders  are  responsible  for  all  work  executed 
under  their  lease,  they  rely  on  their  SEMS  to  guide  their 
operators  and  contractors  as  they  perform  safety  and  envi¬ 
ronmental  activities. 

The  bridging  process  involves  a  meeting  between  manage¬ 
ment  personnel  of  each  operator  to  align  their  safety  and 
environmental  management  systems.  In  cases  where  an 
operator  does  not  have  a  safety  and  environmental  man¬ 
agement  system,  the  companies'  safe  work  practices  are 
used  instead.  Often,  the  operator  the  leaseholder  contracts 
adopts  the  SEMS  of  that  leaseholder  as  its  guiding  system 
for  safety  management  during  the  contracted  work  period. 
In  all  cases,  all  contracted  work  between  parties  on  the  OCS 
is  completed  after  signing  a  bridging  agreement. 

Additional  Players,  Additional  Risk 

There  is  a  characteristic  of  the  bridging  process  that  presents 
an  added  element  of  risk  to  OCS  operations.  Although  com¬ 
pany  management  agrees  upon  the  safety  and  environmen¬ 
tal  protection  measures  to  be  followed  during  the  contract 
period,  the  operational  interface  exists  between  persons 
in  charge  of  the  facilities  or  vessels,  and  these  people  are 
not  always  involved  in  the  bridging  process.  To  reduce  the 
risk  of  human  error  due  to  procedural  misunderstanding. 
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the  bridging  relationship  should  be  more  aligned  with  the 
working  relationship. 

Subcontracting  also  separates  the  leaseholder  from  some 
of  the  operators  working  on  its  lease.  For  example,  an  oil 
and  gas  company  hires  a  contractor  to  perform  dive  opera¬ 
tions  at  its  facility,  and  that  contractor  then  contracts  a  vessel 
operator  to  remain  on  station  for  those  activities.  While  the 
production  facility  may  have  a  bridging  agreement  with  the 
dive  contractor,  it  may  not  have  a  bridging  agreement  with 
the  vessel  that  is  station-keeping  next  to  the  facility.  This 
complicates  the  safety  relationship. 

Further,  although  the  bridging  process  between  parties 
helps  to  mitigate  the  risk  for  safety  and  environmental  inci¬ 
dents,  the  operational  scheme  at  an  offshore  lease  site  can 
be  extremely  complex.  An  offshore  facility  typically  utilizes 
multiple  vessels  for  operational  or  support  services.  One 
industry  norm  is  to  have  vessels  maintain  distance  beyond 
500  meters  from  the  facility  to  reduce  risk  until  vessel  ser¬ 
vices  are  actively  needed.  When  facility/ vessel  interface  is 
required,  the  vessels  will  proceed  inside  the  500-meter  zone 
under  the  direction  of  the  leaseholder. 

While  the  master  controls  the  condition  and  safety  of  the 
vessel,  the  facility  (leaseholder)  directs  its  movements.  Risk 
is  elevated  when  vessels  are  in  close  proximity  to  offshore 
facilities  where  the  transfer  of  personnel,  bulk  liquids,  or 
equipment  takes  place.  While  safety  procedures  aim  to  con¬ 
trol  the  risk  associated  with  common  offshore  activity,  mul¬ 
tiple  players  are  involved  and  rely  upon  each  other  to  safely 
complete  the  evolution. 

An  environment  that  has  a  variety  of  parties,  each  with  their 
own  degree  of  responsibility  over  the  operations,  may  pro¬ 
vide  a  false  sense  of  safety  over  the  entire  operation.  The 
leaseholder  is  rigidly  accountable  to  all  its  contractors  to 
ensure  they're  following  the  appropriate  safe  work  practices. 
All  operators  and  contractors  are  confident  that  every  per¬ 
son  on  the  job  is  following  the  procedures  and  is  responsible 
for  safety  in  their  work  area.  This  perception  may  remove  a 
sense  of  vulnerability  among  the  workers  at  the  lease  site, 
prompting  them  to  let  down  their  guard  regarding  potential 
hazards  around  them. 

While  safety  and  environmental  management  systems 
introduce  more  procedures  to  control  the  probability  of 
human  error,  they  must  be  backed  up  by  a  safety  culture 
that  influences  crew  attitudes  and  perceptions.  Crew  par¬ 
ticipation  and  ownership  of  the  SEMS  is  an  effective  way  to 
improve  understanding  of  the  capabilities  and  limitations  of 


Coast  Guard  personnel  observe  dynamic  positioning  operations  on  an  off¬ 
shore  service  vessel.  U.S.  Coast  Guard  photo  courtesy  of  LT  Jason  Kling. 


the  system's  policies  and  procedures.  The  offshore  lease  site 
may  have  multiple  active  safety  and  environmental  man¬ 
agement  systems  and  bridging  agreements,  so  it's  critical 
that  workers,  in  addition  to  safety  managers,  understand 
the  appropriate  procedures  to  be  followed. 

Additionally,  the  leaseholder  is  responsible  for  all  activities 
at  the  lease  site  and  should  ensure  that  the  safety  culture  of 
each  contractor  facilitates  realistic  perceptions  of  the  state  of 
offshore  safety.  Safety  performance  indicates  that  offshore 
operators  have  been  effectively  managing  the  risk  of  safety 
and  environmental  accidents  with  SEMS,  but  that  doesn't 
mean  the  risk  isn't  present.  The  risk  is  always  present,  and 
operators,  contractors,  and  regulators  must  be  vigilant  to 
continue  to  properly  utilize  safety  and  environmental  man¬ 
agement  systems  to  prevent  safety  and  environmental  inci¬ 
dents  on  the  outer  continental  shelf. 

About  the  author: 

LT  Jason  Kling  recently  transferred  to  the  Marine  Safety  Center  from  the 
Office  of  Design  and  Engineering  Standards.  He  graduated  from  the  U.S. 
Coast  Guard  Academy  in  2005  and  the  University  of  Maryland  Clark 
School  of  Engineering  in  2013.  His  tours  include  Sector  New  York  and  Sec¬ 
tor  Mobile. 

Endnotes: 

L  Safety  Management  Systems  (SMS)  is  the  term  used  by  the  marine  industry,  while 
Safety  and  Environmental  Management  Systems  (SEMS)  is  the  term  used  by  the 
offshore  industry.  The  two  terms  represent  the  same  concept  of  a  system  of  poli¬ 
cies  and  procedures  used  to  manage  safety  and  environmental  risks  associated 
with  work  activities. 

2-  75  FR  63610,  "Oil  and  Gas  and  Sulphur  Operations  in  the  Outer  Continental 
Shelf — Safety  and  Environmental  Management  Systems." 

3-  78  FR  20423,  "Oil  and  Gas  and  Sulphur  Operations  in  the  Outer  Continental 
Shelf — Revisions  to  Safety  and  Environmental  Management  Systems." 

4-  78  FR  55230,  "Safety  and  Environmental  Management  System  Requirements  for 
Vessels  on  the  U.S.  Outer  Continental  Shelf." 
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Creating  an  Effective  Safety  and 
Environmental  Management 
System  for  Offshore  Oil 
and  Gas  Operations 

Adopting  performance-based  requirements 
into  a  hybrid  regulatory  regime. 

by  Mr.  Stanislaus  Kaczmarek,  P.E. 

SEMS  Section  Chief 

Bureau  of  Safety  and  Environmental  Enforcement 
U.S.  Department  of  the  Interior 


The  Bureau  of  Safety  and  Environmental  Enforcement 
(BSEE)  within  the  U.S.  Department  of  the  Interior  develops, 
administers,  and  enforces  regulatory  programs  to  ensure 
that  lessees,  operators,  and  their  contractors  conduct  safe 
and  environmentally  sound  operations  during  exploration 
and  development  of  our  nation's  oil,  gas,  and  renewable 
energy  resources  on  the  outer  continental  shelf  (OCS). 

BSEE's  major  functions  include: 

•  developing  safety  and  environmental  regulations, 

•  evaluating  industry  standards, 

•  permitting, 

•  facility  inspections, 

•  investigating  incidents  and  equipment  failures, 

•  research, 

•  safety  and  environmental  enforcement,  and 

•  promoting  performance-based  safety  and  environmen¬ 
tal  management  systems  (SEMS). 

SEMS  is  a  key  initiative,  in  which  the  Bureau  of  Safety  and 
Environmental  Enforcement  requires  adopting  internal  pro¬ 
cesses  and  work  practices  to  facilitate  and  effectively  man¬ 
age  safety  and  environmental  hazards  encountered  during 
OCS  activities.  The  driving  force  behind  SEMS  is  a  belief 
that  safety  and  environmental  management  effectiveness 
will  grow  from  an  improved  awareness  of  the  safety  and 
environmental  hazards  confronted  by  the  workforce. 


Effectiveness  will  also  grow  when  workers  are  provided  a 
say  in  how  to  best  mitigate  the  recognized  hazards  in  the 
context  of  their  operations,  an  ability  to  measure  the  suc¬ 
cess  of  risk  management  via  performance  indicators,  and 
a  willingness  to  continually  learn  from  past  experiences 
so  that  risks  may  be  eliminated  or  mitigated  during  future 
evolutions. 

As  compared  with  BSEE's  historical  regulatory  approaches, 
SEMS  further  introduces  an  acceptance  of  flexibility  in  how 
performance  is  measured  and  how  it  is  achieved,  allowing 
the  operator  to  design  a  program  that  will  work  within  the 
organization  and  management  culture. 

A  Hybrid  Approach  to  Regulation 

One  aim  of  BSEE's  approach  to  safety  and  environmental 
management  system  enforcement  is  to  provide  lessees  and 
operators  the  flexibility  to  implement  a  performance-based 
management  system  that  works  in  their  cultures  while  still 
requiring  them  to  continue  to  adhere  to  all  of  BSEE's  pre¬ 
scriptive  and  other  performance-based  requirements.1  In 
many  ways,  SEMS  builds  upon  the  foundation  of  prescrip¬ 
tive  regulations  and  established  industry  standards. 

The  bureau's  regulatory  requirements  define  a  baseline  of 
technologies  and  safety  and  environmental  barriers  that 
operators  must  install,  maintain,  test,  and  use  in  oil  and 
gas  work  on  the  OCS.  These  regulations  include  a  variety 
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SEMS  Compliance  Requirements 

i. 

A  safety  and  environmental  management  system  (SEMS)  has 
been  defined. 

2. 

It  addresses  all  provisions  of  30  CFR  250,  Subpart  S. 

3. 

There  is  evidence  of  ongoing  attempts  to  implement  it  in  the 
field. 

4. 

An  independent  and  accredited  third  party  audits  it  at  least 
once  every  three  years. 

5. 

The  associated  SEMS  audit  plans,  SEMS  audit  reports,  and 
corrective  action  plans  are  submitted  to  BSEE  within  the 
timeframes  listed  in  Subpart  S. 

of  prescriptive  and  performance-based  requirements 
that  address  specific  equipment  or  operations,  includ¬ 
ing  specific  requirements  for  drilling  (Subpart  D  of 
BSEE  regulations  —  30  CFR  250),  well  completion 
(Subpart  E),  well  workover  (Subpart  F),  well  control 
(Subpart  O),  and  decommissioning  (Subpart  Q).  Addi¬ 
tional  requirements  address  production  safety  (Sub¬ 
part  H),  the  safe  design  and  operation  of  platforms  and 
structures  (Subpart  I),  and  pipelines  (Subpart  J). 

The  SEMS  regulations  (Subpart  S)  build  on  these 
requirements  by  specifying  that  companies  must  man¬ 
age  the  human  interfaces  and  interactions  required  to 
operate  on  the  outer  continental  shelf  and  to  handle 
the  complexity  of  information  flow  in  oil  and  gas  work 
to  ensure  safe  operations.  A  fundamental  principle  of  SEMS 
is  that  operators  assess  and  evaluate  all  hazards  associated 
with  their  operations,  then  work  to  eliminate  or  mitigate  the 
unacceptable  risks  associated  with  those  hazards. 

Detailed  regulations  focusing  on  specific  pieces  of  equip¬ 
ment  or  specific  tasks  are  often  not  broad  enough  to  ensure 
safe  operations  in  every  possible  scenario.  Safety  and  envi¬ 
ronmental  management  systems,  on  the  other  hand,  guide 
operators  to  look  at  the  big  picture,  taking  into  account  how 
activities  or  changes  in  one  area  may  impact  safety  and 
environmental  aspects  of  operations  in  another. 

Detailed  equipment-related  regulations  addressing  specific 
issues  may  take  years  to  develop  and  promulgate.  A  perfor¬ 
mance-based  regulation  such  as  SEMS  allows  the  regulator 
to  focus  on  broader  safety  objectives  and  the  mitigation  of 
risks.  This  gives  industry  the  flexibility  and  responsibility  to 
determine  the  best  way  to  achieve  such  objectives  without 
waiting  for  new  regulatory  requirements. 

Adding  SEMS  requirements  into  the  BSEE  program  is  a  clear 
indication  that  the  bureau  is  moving  toward  adopting  more 
performance-based  requirements  into  its  existing  hybrid 
regulatory  regime. 

Challenges  in  Adopting  Performance-Based  Regulations 

The  industry  view  toward  adding  a  performance-based 
requirement  (i.e.  SEMS)  to  the  OCS  regulatory  program 
was  mixed.  Early  on,  some  of  the  regulated  community 
approached  the  SEMS  requirements  as  a  mandate  to  write  a 
series  of  procedures  as  outlined  in  the  regulations,  and  then 
show  them  to  the  regulator  whenever  asked.  Auditors  were 
also  hesitant  to  share  their  observations,  whether  they  were 
areas  of  excellence  or  weakness  in  the  management  system 
approaches.  The  emphasis  appeared  to  be  on  documenting 
compliance  instead  of  assessing  performance. 


From  BSEE's  perspective,  we  needed  to  establish  alternate 
approaches  to  enforcement,  looking  at  the  overall  commit¬ 
ment  and  application  of  a  management  system  approach 
rather  than  looking  at  each  activity  within  the  management 
system  as  a  compliance  vs.  nonconformance  opportunity. 
Thus,  the  Bureau  of  Safety  and  Environmental  Enforcement 
made  the  decision  not  to  issue  incidents  of  noncompliance 
for  deficiencies  identified  through  a  safety  and  environmen¬ 
tal  management  systems  audit  unless  the  overall  conclusion 
was  that  the  management  system  did  not  really  exist. 

To  further  demonstrate  our  commitment  to  viewing  safety 
and  environmental  management  systems  differently  than 
the  way  we  enforce  our  other  regulatory  requirements,  the 
bureau  lists  a  limited  number  of  items  by  which  SEMS  com¬ 
pliance  can  currently  be  assessed  (see  table  above). 

By  focusing  solely  on  compliance  during  a  safety  and 
environmental  management  system  audit  rather  than 
assessing  system  effectiveness,  the  auditee  creates  a  barrier 
to  achieving  the  full  potential  of  SEMS.  An  excessive  focus 
on  compliance  with  specific  requirements  can  also  create  a 
false  sense  of  safety  within  the  workforce,  as  individuals 
may  assume  that  everyone  is  following  the  same  procedures 
and  standards,  and  that  they  are  all  effective. 

The  Bureau  of  Safety  and  Environmental  Enforcement, 
building  on  its  enforcement  foundation,  also  needed  to  view 
safety  and  environmental  management  systems  differently, 
shifting  from  inspecting  for  compliance  to  inspecting  for 
safety.  For  the  most  part,  BSEE  compliance  expectations 
for  SEMS  largely  deal  with  creating,  rolling  out,  and  main¬ 
taining  a  SEMS  program.  If  there  is  evidence  of  a  demon¬ 
strated,  ongoing  commitment  to  find  and  fix  weaknesses  in 
the  management  system,  then  the  bureau  will  support  those 
commitments. 
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Safety  and  Environmental  Management  System  Regulations 


SEMS  regulations  required  that  operators  and  lessees  design 
and  implement  an  outer  continental  shelf  management 
system  by  November  2011.  The  components  of  that  manage¬ 
ment  system  were  based  in  large  part  on  an  American  Petro¬ 
leum  Institute  Recommended  Practice  for  a  Safety  and 
Environmental  Management  Program  (API  RP  75)  last  updated 
in  2004. 

Both  the  Bureau  of  Safety  and  Environmental  Enforcement 
regulation  and  API  RP  75  defined  those  management  system 
components  as: 

•  management  responsibilities  and  practices, 

•  safety  and  environmental  information, 

•  hazard  assessment, 

•  change  management, 

•  operating  procedures, 

•  safe  work  practices, 

•  training, 

•  quality  assurance  and  mechanical  integrity, 

•  pre-startup  review, 

•  emergency  response, 

•  incident  investigation, 

•  auditing,  and 

•  records  management. 

Then,  in  2013,  the  Bureau  of  Safety  and  Environmental 
Enforcement  proposed  additional  requirements  beyond  those 
contained  in  API  RP  75  for  each  operator's  or  lessee's  safety 
and  environmental  management  system.  These  proposals 
became  requirements  in  2014  and  2015  and  included: 

•  establishing  stop  work  authority, 

•  naming  an  ultimate  work  authority, 

•  formalizing  an  employee  participation  program, 


•  reporting  unsafe  working  conditions, 

•  enhancing  job  safety  analyses  through  review  and  signa¬ 
ture  by  all  workers  and  management  involved  in  a  job 
task,  and 

•  accreditation  for  lead  auditors  performing  the  SEMS 
audits  called  for  in  the  regulation. 

Through  conversations  with  offshore  industry  representatives 
and  other  stakeholders,  BSEE  is  currently  exploring  whether 
additional  or  alternate  approaches  are  needed  to  enforce  the 
SEMS  regulations  or  if  revisions  to  API  RP  75  are  desired  so 
that  the  performance-based  aspects  of  the  regulation  can  be 
further  strengthened. 

The  focus  of  these  inquiries  surrounds  the  best  ways  to  close 
perceived  gaps  in  the  following  areas: 

•  contractor  SEMS  (BSEE  is  currently  requiring  only  oper¬ 
ators  and/or  lessees  to  implement  30  CFR  Part  250, 
Subpart  S); 

•  risk  assessment  methodologies  (the  current  regulations 
do  not  specify  how  the  hazard  assessment  is  to  be  used 
to  mitigate  risks); 

•  human  factors  (the  current  regulations  do  not  specify 
what  types  of  human  factor  considerations  are  essential 
to  growing  a  safety  culture); 

•  performance  indicators  (though  SEMS  is  a  performance- 
based  regulation,  there  is  little  attention  as  to  how  to 
measure  performance);  and 

•  SEMS  auditing  requirements  (the  content  of  audit  reports 
needs  to  be  improved  to  ensure  that  the  effectiveness  of 
the  programs  and  audits  can  be  measured). 

BSEE  is  working  with  the  API  committee  that  is  responsible  for 
RP  75  as  well  as  the  Offshore  Energy  Safety  Institute  to  iden¬ 
tify  and  frame  any  opportunity  for  making  SEMS  both  a  more 
effective  regulation  and  a  widely  adopted  standard  practice. 


How  BSEE  Assesses  SEMS  Success 

Further,  the  Bureau  of  Safety  and  Environmental  Enforce¬ 
ment  works  with  stakeholders  to  determine  and  document 
what  effectiveness  and  performance  in  the  safety  and  envi¬ 
ronmental  management  system  elements  look  like,  and  how 
they  can  be  measured.  For  example,  the  bureau  uses  infor¬ 
mation  from  several  sources  to  assess  whether  individual 
operators  use  safety  and  environmental  management  sys¬ 
tems  effectively,  including  feedback  from  BSEE's  inspectors, 
incident  investigations,  audit  plans,  audit  reports,  and  cor¬ 
rective  action  plans  that  regulations  require  be  submitted 
to  BSEE. 


Companies  can  demonstrate  a  commitment  to  use  safety 
and  environmental  management  systems  to  drive  safe 
behaviors  and  continual  improvement  in  safety  and  envi¬ 
ronmental  performance  by  providing  evidence  regarding 
which  aspects  of  the  management  system  are  working  and 
which  are  not,  and  then  demonstrating  that  steps  to  close 
those  gaps  have  been  identified  and  are  being  implemented. 

The  Bureau  of  Safety  and  Environmental  Enforcement  also 
sponsors  research  to  define  quantifiable,  SEMS-appropriate 
key  performance  indicators  for  individual  operators,  which 
it  will  share  with  industry.  Eventually,  if  industry  accepts 
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and  adopts  these  or  similar  performance  indicators,  they 
will  provide  an  indication  not  only  as  to  whether  safety 
and  environmental  management  systems  influence  OCS 
behaviors,  but  also  if  change  in  those  behaviors  is  making  a 
measurable  difference. 

Finally,  BSEE  will  assess  if  SEMS  effectively  guides  better 
safety  and  environmental  performance  throughout  the  oil 
and  gas  OCS  industry  by  monitoring  and  promoting  the 
sharing  of  information  on  risk  areas  and  best  practices  with 
the  rest  of  industry. 

To  assist  industry  in  this  regard,  the  bureau  has  partnered 
with  the  Bureau  of  Transportation  Statistics  (BTS)  to  set  up 
a  near-miss  reporting  system.  BTS  is  one  of  the  13  principal 
statistical  agencies  Congress  authorized  under  the  Confi¬ 
dential  Information  Protection  and  Statistical  Efficiency  Act 
to  collect  and  handle  information  in  ways  that  protect  the 
confidential  and  proprietary  nature  of  such  information  and 
their  sources  while  still  using  it  to  provide  actionable  intel¬ 
ligence  for  others  in  the  industry.  Reports  can  be  made  in 
confidence  at  www.SafeOCS.gov  or  by  calling  1-844-OCS- 
FRST  (1-844-627-3778). 

Auditing 

The  audit  report  is  the  main  source  of  detailed  information 
BSEE  receives  on  what's  working  in  the  safety  and  environ¬ 
mental  management  system  and  what  is  not.  The  bureau's 
SEMS  regulations  require  that  lessees  and  operators  receive 
a  third-party-led  audit  of  their  management  system  every 
three  years,  and  that  this  triennial  audit  sample  the  effec¬ 
tiveness  of  the  management  system  in  controlling  safety 
and  environmental  risks  on  15  percent  of  each  operator's 
OCS  facilities. 

When  SEMS  was  first  put  into  effect,  the  audit  reports  BSEE 
received  focused  more  on  statements  of  compliance  rather 
than  on  evidence  of  effectiveness.  While  it's  easy  to  have  a 
documented  management  system  that  contains  verbiage 
referenced  in  a  regulation,  it  is  much  more  difficult  to  define 
and  test  a  system  that  management  willingly  supports,  pro¬ 
motes,  and  actually  empowers  all  workers  to  think  and 
participate  in  safety  and  environmental  protection,  and  is 
subsequently  used  in  disciplined  ways  every  day. 

One  way  to  ensure  the  audit  reports  provide  better  value 
to  the  operator  and  to  BSEE  is  to  create  and  enforce  stan¬ 
dards  on  how  an  audit  should  be  conducted  and  reported. 
To  support  this,  the  Bureau  of  Safety  and  Environmental 
Enforcement  requires  that  accredited  auditors  lead  each 
SEMS  audit,  working  with  the  Center  for  Offshore  Safety,2 
to  change  the  way  lessees  and  operators  approach  these 
third-party-led  audits. 


Just  as  an  effective  safety  and  environmental  management 
system  must  be  based  on  knowledge  of  the  hazards  that 
need  to  be  managed,  BSEE  is  working  with  the  Center  for 
Offshore  Safety  to  adopt  a  systematic  approach  to  auditing 
in  which  specific,  observed  hazards  in  a  facility  or  in  an 
operation  become  the  starting  point  for  exploring  how  (or  if) 
the  management  system  has  recognized  the  hazards,  miti¬ 
gated  the  risks,  and  improved  the  risk  controls  over  time. 
This  approach  will  give  the  audit  team  an  opportunity  to 
evaluate  whether  the  elements  of  the  management  system 
are  integrated  into  the  full  operating  process. 

Furthermore,  audit  service  providers  are  being  asked  to  try 
to  begin  the  assessment  of  possible  root  causes  for  any  find¬ 
ings  to  determine  if  an  observation  reflects  a  random  occur¬ 
rence  or  a  more  systemic  issue.  Both  scenarios  pose  different 
risks  to  the  safety  of  operations,  and  such  an  assessment  can 
guide  the  operator  to  adopt  the  appropriate  mitigation  steps 
to  prevent  a  recurrence. 

The  bureau's  current  regulations  require  that  reports  sum¬ 
marizing  the  SEMS  audit  be  submitted  to  BSEE  and  that 
they  highlight  the  audit  team's  findings,  observations,  and 
conclusions,  identifying  deficiencies.  This  then  enables  BSEE 
to  fulfill  its  regulatory  obligation  to  determine  if  the  associ¬ 
ated  corrective  action  plan  proposed  by  the  lessee  or  opera¬ 
tor  will  be  effective  in  closing  the  gaps  and  improving  the 
ability  of  the  management  system  to  control  risks. 

To  help  in  this  regard,  the  bureau  is  also  working  with  the 
Center  for  Offshore  Safety  to  create  a  more  detailed  defini¬ 
tion  of  the  evidence  that  should  be  provided  in  an  audit 
report.  By  providing  guidance  on  what  should  be  included 
in  a  safety  and  environmental  management  system  audit 
report,  BSEE  anticipates  receiving  a  more  representative 
assessment  of  OCS  operator  safety  performance  than  has 
been  provided  in  the  past. 

Continual  Improvement 

A  recurring  theme  in  all  management  systems,  and  in 
BSEE's  approach  to  SEMS,  is  the  belief  that  an  effective 
management  system  must  be  continually  tested  and  quickly 
improved  every  time  it  is  found  to  be  weak  in  1)  recogniz¬ 
ing  hazards  that  exist,  or  2)  in  empowering  every  person 
who  faces  those  hazards  with  the  knowledge,  protocols, 
equipment,  and  support  they  need  to  control  them.  As  we 
learn  more,  we  will  consider  modifying  our  approaches  or 
employing  more  of  the  tools  at  our  disposal. 

The  bureau's  approach  to  SEMS  promotion  can  be  summa¬ 
rized  as  follows: 

•  Learn  from  operators  who  have  a  robust  safety  and  envi¬ 
ronmental  management  system  by  focusing  on  what  is 
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working  well  in  their  management  system  implementa¬ 
tion  and  helping  such  operators  inform  and  promote 
consideration  of  those  activities  they  have  found  to  be 
particularly  important  in  managing  risks. 

•  Ensure  that  when  operators  commit  to  corrective  actions 
in  response  to  SEMS  audits,  that  these  actions  address 
not  only  the  specific  deficiency  identified  by  the  audi¬ 
tor  but  also  the  underlying  systematic  weaknesses 
contributing  to  the  deficiency.  In  some  instances,  a  cor¬ 
rective  action  may  require  that  changes  to  the  safety 
and  environmental  management  system  design  or 
implementation  be  made  across  an  operator's  full  net¬ 
work  of  facilities. 

Along  these  lines,  BSEE  hopes  to  engage  operators  in  deeper 
dialogue  regarding  the  creation  and  management  of  their 
corrective  action  plans.  For  example,  the  Bureau  of  Safety 
and  Environmental  Enforcement  may  request  that  company 
investigators  looking  into  specific  incidents,  near-misses,  or 
gaps  found  by  their  auditors  dig  deeper  to  identify  and  fix 
the  technical  and  human  root  causes  rather  than  just  the 
more  obvious  symptoms. 

In  cases  where  BSEE  becomes  concerned  about  the  effec¬ 
tiveness  of  an  operator's  management  system,  perhaps  due 
to  recurring  or  severe  incidents,  the  bureau  may  require  a 
company  to  perform  a  directed  audit  outside  of  the  normal 
three-year  schedule  to  identify  potential  shortfalls  and  pro¬ 
vide  the  operator  with  additional  knowledge  on  where  their 
systems  may  require  improvement. 


The  bureau  may  conduct  its  own  investigations  into  the 
robustness  and  effectiveness  of  one  or  more  of  the  opera¬ 
tor's  safety  and  environmental  management  system  ele¬ 
ments,  requiring  the  findings  to  be  acted  upon.  Normally 
this  action  is  taken  when  a  new  operator  comes  into  the 
field  or  when  there  are  specific,  focused  concerns  that  BSEE 
inspectors  have  raised. 

For  those  operators  who  do  not  have  a  functioning  safety 
and  environmental  management  system,  BSEE  can  require 
the  lessee  or  operator  to  cease  operations  until  they  can 
demonstrate  they  have  a  SEMS  in  place,  and  that  it  plays  an 
important  role  in  day-to-day  operations. 
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Endnotes: 

1-  Prescriptive  regulations  specify  what  to  do,  and  sometimes  how  to  do  it.  Perfor¬ 
mance-based  regulations  specify  performance  criteria  and  leave  it  to  the  regulated 
party  as  to  how  best  to  achieve  it. 

2-  In  June  2015,  BSEE  named  the  Center  for  Offshore  Safety  an  official  audit  service 
provider  accreditation  body. 
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Vessel  Inspections 


ISM  Code  and  Vessel  Safety 
Management  Systems 

Reading  between  the  lines  to  optimize  compliance. 


by  Mr.  Jason  M.  Yets 
Marine  Inspector/Instructor 
Cruise  Ship  National  Center  of  Expertise 
U.S.  Coast  Guard 


All  passenger  ships,  regardless  of  tonnage,  must  comply  with 
the  International  Safety  Management  (ISM)  Code,  enforced 
through  the  International  Convention  for  the  Safety  of  Life 
at  Sea  (SOLAS).  As  required  by  the  code,  these  passenger 
ships  must  employ  a  safety  management  system  (SMS). 

A  typical  cruise  ship  safety  management  system  is  an 
incredibly  large,  multi-layered  system  consisting  of  thick 
volumes  of  books  and  manuals — or,  more  commonly,  com¬ 
puter-based  references.  It  encompasses  all  the  rules,  regula¬ 
tions,  policies,  processes,  and  procedures  a  company  and 
ship  employ  to  make  sure  everyone  uses  the  same  rulebook 
to  ensure  consistency. 

First,  a  company  designs,  develops,  and  implements  its  SMS. 
Then  its  flag  administration1  or  an  organization  the  admin¬ 
istration  recognizes  (commonly  referred  to  as  the  "recog¬ 
nized  organization,"  or  RO)  approves  it  and  issues 
a  safety  management  certificate  (for  the  ship)  and  a 
document  of  compliance  (for  the  company). 

Shipboard  personnel  play  an  integral  role  in  SMS 
self-management.  If  a  policy,  procedure,  or  form 
is  not  being  followed,  or  in  practicality  does  not 
work  on  the  vessel  for  which  it  was  developed,  the 
crewmember  must  use  the  defined  lines  of  commu¬ 
nication  established  within  the  safety  management 
system  to  report  such  shortcomings. 

Audits 

The  company  undergoes  required  internal  audits 
every  12  months  to  ensure  compliance  during  the 
certificate's  validity.  Members  of  the  company's 
shoreside  personnel  generally  conduct  these  audits 
so  that  the  examined  areas  are  reviewed  by  some¬ 
one  not  associated  with  them. 


The  administration,  either  directly  or  through  a  recognized 
organization,  also  performs  a  thorough  examination  of  the 
vessel  annually.  During  this  time,  auditors  identify  if  the 
vessel  is  working  within  the  confines  of  the  safety  manage¬ 
ment  system. 

Lastly,  port  states2  have  a  vested  interest  in  vessels  that  call 
on  their  ports  and  navigate  in  their  waters.  The  U.S.  Coast 
Guard  (USCG)  examines  each  foreign-flagged  cruise  ship 
through  its  foreign  passenger  vessel  exam  program  at  least 
twice  per  year.  Though  port  state  control  officers  (PSCOs) 
mainly  examine  the  vessel  for  substantial  compliance  with 
federal  law  and  international  regulation,  this  exam  is  not 
limited  to  those  groups  of  rules.  USCG  PSCOs  will  also  ver¬ 
ify  that  the  vessel  is  being  operated  in  accordance  with  the 
company's  safety  management  system. 


A  ship's  officer  explains  safety  management  system  testing  procedures  to  USCG  exam¬ 
iners.  All  photos  courtesy  of  the  Cruise  Ship  National  Center  of  Expertise. 
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Ship  emergency  teams  discuss  safety  management  system  procedures  with  USCG  examiners 
after  a  fire  drill. 


Further  into  the  exam,  the  port  state  con¬ 
trol  officer  learns  that  the  company  recently 
implemented  a  new  policy  into  the  SMS.  As 
a  result  of  a  recent  accident  on  a  sister  ship, 
the  company  decided  that  using  charged  air 
cylinders  during  drills  was  an  unnecessary 
risk  until  all  the  cylinders  could  be  tested. 
The  regulations  note  that  a  drill  should  be  "as 
realistic  as  possible,"  and  the  company  did, 
indeed,  deem  it  as  realistic  as  possible  without 
incorporating  an  unnecessary,  identified  risk. 
Since  the  company  still  uses  these  cylinders 
during  regular  controlled  training  to  ensure 
crew  proficiency,  the  PSCO  should  have  no 
concern. 


There  can  be  a  fine  line  in  making  such  judg¬ 
ment  calls.  Though  there  was  no  cause  for 
concern  in  the  previous  example,  one  must 
read  the  SMS  carefully  for  each  situation.  For 
example,  if  the  ship's  SMS  stated  that  all  fire¬ 
fighters  were  to  have  fully  operational  equip¬ 
ment  during  fire  drills  and  they  had  to  breathe 
air  from  the  cylinder  to  promote  realism,  then 
the  same  situation  would  constitute  a  viola¬ 
tion  of  the  ship's  procedures.  By  extension,  it 
would  also  constitute  a  nonconformity  with 
the  requirements  of  their  safety  management 
certificate. 


Students  learn  how  to  evaluate  ships’  safety  management  systems  as  part 
Passenger  Vessel  Examiners  Course. 

Compliance 

Let's  look  at  how  USCG  PSCOs  use  a  ship's  SMS  to  evaluate 
and  enforce  compliance.  First  of  all,  identifying  the  way  a 
ship  "lives"  is  the  key  to  understanding  a  ship's  safety  man¬ 
agement  system  and  its  relation  to  the  ISM  Code.  Beyond 
examining  the  required  paperwork  to  ensure  all  the  "i"s  are 
dotted  and  the  "t"s  crossed,  it's  equally  important — if  not 
more  so — to  see  how  the  crew  manages  the  vessel  accord¬ 
ing  to  the  SMS. 

Example  1 — Fire  Drill  Anomaly:  A  port  state  control  offi¬ 
cer  notices  that  none  of  the  firefighters  have  an  air  cylin¬ 
der  attached  to  the  breathing  apparatus  during  a  fire  and 
abandon-ship  drill.  The  PSCO  immediately  identifies  a  pos¬ 
sible  deficiency  against  Chapter  III  of  SOLAS.  Any  port  state 
control  officer  knows  that  SOLAS  requires  drills  to  be  per¬ 
formed  in  a  realistic  manner,  but  the  absence  of  this  cylinder 
makes  the  drill  unrealistic,  as  a  firefighter  would  never  go 
into  a  fire  without  an  air  source. 


Example  2 —  Ship's  Systems:  During  an 
exam  of  engineering  spaces,  the  PSCO  notes 
of  the  Foreign  a  seconcjary  Qji  content  meter  (OCM), 

commonly  referred  to  as  the  "white  box,"  isn't 
operating.  There's  no  regulatory  requirement 
for  this  secondary  system,  but  it  is  required  according  to  the 
ship's  SMS.  Even  though  neither  domestic  nor  international 
regulations  apply,  established  company  policy,  approved  by 
the  vessel's  flag  state,  provides  for  nonconformance  with  the 
requirements  of  the  safety  management  certificate. 


Example  3  —  The  Human  Factor:  During  vessel  walk¬ 
through,  the  port  state  control  officer  notices  that  tables  and 
chairs  block  an  emergency  escape  route.  The  shipboard  offi¬ 
cer  notes  they're  stored  there  because  they  have  no  more 
storage  space  available.  The  PSCO  makes  note  of  this  defi¬ 
ciency,  and  later,  when  he  or  she  reports  this  finding  to  the 
lead  examiner,  it's  identified  that  the  vessel  was  issued  the 
same  deficiency,  in  the  same  location,  with  the  same  tables 
and  chairs,  for  the  last  three  exams.  While  it's  obviously  a 
problem  that  the  tables  and  chairs  are  stored  there,  the  big¬ 
ger  problem  lies  in  that  the  issue  is  recurring,  with  no  cor¬ 
rective  actions  taken  to  rectify  the  identified  nonconformity. 
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In  Practice 

These  three  scenarios  show  that  when  the  PSCO  identifies 
a  nonconformity  with  the  ship's  SMS,  understanding  writ¬ 
ing  the  deficiency  to  the  ISM  Code  is  important.  The  code 
itself  must  be  cited,  but  not  without  regulation  to  support  it; 
SOLAS  Chapter  IX/3  is  the  supporting  regulation,  making 
compliance  with  the  code  mandatory.  Lastly,  the  PSCO  must 
identify  the  element  of  the  ISM  Code  that  best  describes  the 
standard  the  vessel  is  unable  to  or  has  failed  to  meet. 

Safety  management  systems,  more  often  than  not,  are  far 
more  stringent  than  any  domestic  or  international  law,  as 
it  is  in  the  company's  best  interest  to  protect  their  person¬ 
nel  and  assets.  For  example,  some  companies  require  each 
lifeboat  to  be  lowered  to  the  water  once  a  month,  whereas 
international  regulation  only  requires  this  once  every  three 
months. 

Remember,  we  are  writing  requirements  based  on  each 
vessel's  system  and  their  company's  interpretation  of  the 
system — not  ours.  When  we  identify  issues  where  a  ship's 
crewmembers  aren't  complying  with  their  own  company's 
requirements,  we  should  expand  our  exam  to  ensure  it's  an 
isolated  incident  —  not  systemic.  We  can  also  call  for  the 
vessel's  flag  state  to  conduct  an  external  audit  to  bring  addi¬ 
tional  attention  to  a  noncompliant  condition.  As  a  PSCO,  this 
is  the  end-goal:  to  correct  issues  that  create  unsafe  condi¬ 
tions,  ensuring  a  vessel  is  in  substantial  compliance.3 

Recording  Deficiencies 

Writing  deficiencies  to  a  ship's  SMS  by  way  of  the  ISM  Code 
can  be  confusing,  as  the  code  incorporates  some  vague  ver¬ 
biage,  so  port  state  control  officers  must  ensure  they  are 
directly  correlating  the  deficiency  identified  to  the  corre¬ 
sponding  section  of  the  code. 

The  IMO  has  developed  guidelines  to  assist  companies  in 
establishing  routine  maintenance  intervals  for  shipboard 
systems.  When  using  these  guidelines,  remember  they  are 
just  that — guidelines,  not  requirements.  The  specific  inter¬ 
vals  for  system  maintenance  are  listed  in  the  ship's  safety 
management  system.  These  intervals  are  what  the  company 
and  flag  state  have  agreed  to,  and  thus  can  be  held  to,  unless 
the  administration  approves  otherwise. 

Let's  review  the  previous  examples  and  identify  the  best 
possible  method  to  record  deficiencies: 

Example  1 — Fire  Drill  Anomaly:  The  firefighters  lacked 
an  air  cylinder  during  the  fire  drill,  but  the  company  SMS 


identified  the  reason  for  this  deviation  from  "realistic,"  so 
there  is  no  problem  and  no  deficiency  should  be  recorded. 
However,  if  the  SMS  stated  that  all  firefighters  must  breathe 
air  from  the  cylinder,  but  they  didn't,  then  PSCOs  should 
record  this  requirement,  following  it  with  the  identified 
deficiency. 

Example  2 —  Ship's  Systems:  The  secondary  OCM,  or 
"white  box,"  was  not  functioning.  Although  regulation 
doesn't  require  this,  the  company's  safety  management 
system  does.  Part  A  of  the  ISM  Code,  1.2. 2. 2,  requires  that 
the  company  assess  all  identified  risks  to  the  environment 
and  establish  appropriate  safeguards.  In  this  instance,  the 
company  established  the  risk  of  accidental  discharge,  imple¬ 
mented  a  secondary  OCM,  and  it  was  discovered  to  be  non¬ 
functioning.  This  again  shows  that  what  the  policy  states 
should  be  functioning  is  not  actually  functioning  "as  the 
ship  lives." 

Example  3  —  The  Human  Factor:  The  same  deficiency  is 
identified  during  each  of  four  concurrent  exams.  Part  A  of 
the  ISM  Code,  9.2,  requires  the  company  to  establish  proce¬ 
dures  to  implement  corrective  action,  including  measures 
to  prevent  recurrence.  There  are  two  ways  to  look  at  this, 
starting  with  where  the  breakdown  occurred — whether  it 
was  within  the  SMS,  or  whether  it  was  a  shipboard  person¬ 
nel  issue.  If  the  requirements  of  Section  9.2  aren't  met  due  to 
a  lack  of  policy  or  procedure,  then  it's  a  clear  nonconformity 
with  the  ISM  Code.  If  it's  a  personnel  issue,  then  we  refer 
again  to  9.2  and  further  support  it  with  SOLAS  Chapter  XI/4. 

The  examples  given  above  are  just  that.  The  examiner's  goal 
is  to  find  the  best  cite  that  most  accurately  correlates  to  the 
finding  and  best  supports  the  deficiency.  The  Cruise  Ship 
National  Center  of  Expertise  stands  ready  to  assist  you,  and 
we  can  also  provide  any  ISM-specific  training  needed. 

About  the  author: 

Mr.  Yets  joined  the  Cruise  Ship  National  Center  of  Expertise  in  2011  follow¬ 
ing  a  shipboard  career  with  a  major  cruise  line,  where  he  was  a  safety  officer. 
He  is  a  marine  inspector  and  instructor  for  the  Cruise  Ship  National  Center 
of  Expertise,  manages  its  basic  foreign  passenger  vessel  examination  training 
program,  and  serves  as  the  unit's  public  affairs  officer. 

Endnotes: 

1-  Administration  is  defined  as  . .  the  government  of  the  state  whose  flag  the  ship 
is  entitled  to  fly."  ISM  Code,  2010  edition. 

2-  A  ship  is  entitled  to  fly  a  designated  state  flag.  When  that  ship  enters  the  waters  of 
any  other  state  flag  during  its  voyage,  that  ship  is  entering  a  "port  state." 

3-  Requests  for  external  audits  by  the  flag  administration  should  be  noted  and  for¬ 
mally  requested  on  the  Form  B.  Navigation  and  Vessel  Inspection  Circular,  04-05, 
"Port  State  Control  Guidelines  for  the  Enforcement  of  Management  for  the  Safe 
Operation  of  Ships  (ISM  Code)"  can  also  provide  additional  guidance. 
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Strengthening  Our  Foundation 

Fostering  an  even  more  robust  safety  culture 
within  the  liquefied  gas  industry. 


by  CDR  Jason  Smith 
Detachment  Chief 

Liquefied  Gas  Carrier  National  Center  of  Expertise 
U.S.  Coast  Guard 


For  more  than  a  half  century,  the  maritime  community 
has  been  safely  transporting  liquefied  gases  over  the  water 
throughout  the  world,  providing  clean-burning  fuel  and 
feedstock  to  industrialized  and  developing  regions  of  the 
globe.  Because  of  the  unique  properties  and  hazards  associ¬ 
ated  with  liquefied  gases,  safety  at  all  stages  is  paramount. 

Safety  First 

It  is  this  mindset  across  the  industry  that  has  allowed  it 
to  maintain  such  an  excellent  safety  record  throughout 
its  more  than  50-year  history.  Much  like  the  key  goal  of  a 
safety  management  system  (SMS),  the  liquefied  gas  commu¬ 
nity —  including  regulators,  independent  standards  orga¬ 
nizations,  trade  organizations,  and,  most  importantly,  the 
industry  itself — all  seek  to  maintain  an  across-the-board 


safety  culture  to  address  the  inherent  dangers  of  this  indus¬ 
try  as  well  as  the  potential  for  human  error  and  omissions. 

This  safety-focused  concept  was  not  new  to  the  liquefied 
gas  industry  during  the  late  1990s  and  early  2000s,  when  the 
International  Safety  Management  (ISM)  Code  and  similar 
U.S.  domestic  requirements  were  implemented,  requiring 
safety  management  systems  for  all  types  of  deep-draft  inter¬ 
national  vessels  and  some  domestic  ships.  Commitment 
from  top  management,  cargo  operational  and  emergency 
procedures,  and  regular  process  reviews  on  liquefied  gas 
carriers  were  put  into  place  decades  earlier — some  even  dat¬ 
ing  back  to  the  principal  concepts  established  in  the  1950s 
by  the  pioneers  of  the  industry's  first  purpose-built  liquefied 
gas  carriers — that  have  been  maintained  ever  since. 
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So  why  did  this  industry  focus  so  strongly  on  safety 
to  achieve  an  across-the-board  "gold  standard" 
from  the  start?  This  question  can  be  answered  by 
understanding  what  a  liquefied  gas  cargo  is,  the 
unique  hazards  associated  with  it,  and  the  public's 
concern  for  the  perceived  risks  these  hazards  pose 
on  the  water. 

According  to  the  International  Maritime  Organiza¬ 
tion  (IMO),  a  liquefied  gas  is  a  gaseous  substance 
at  ambient  temperature  and  pressure,  but  liquefied 
by  pressurization,  refrigeration,  or  a  combination  of 
both.1  The  principal  liquefied  gas  cargoes  include 
liquefied  natural  gas  (LNG),  liquefied  petroleum 
gas  (LPG),  liquefied  ethylene  gas,  and  a  variety  of 
petrochemical  gases.  Each  type  of  liquefied  gas  has 
specific  hazards,  some  that  are  common  with  other 
hydrocarbons  and  some  that  are  unique  to  them¬ 
selves  and/or  other  liquefied  gases. 


Figure  1:  The  primary  components  of  raw  natural  gas,  and  how  the  different  types  of 
natural  gas  are  utilized  in  the  marketplace.  U.S.  Coast  Guard  graphic. 
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The  Regulations 

Some  of  these  safety  culture  concepts  were  first  introduced  by  the 
pioneers  of  the  industry,  and  over  time  they  have  been  improved, 
expanded,  and  formalized  by  international  and  government  regula¬ 
tions,  industry  standards,  and  company  policies.  In  addition  to  the 
International  Safety  Management  (ISM)  Code,  three  international  codes 
specifically  written  for  liquefied  gas  carriers  all  address  the  need  for 
some  type  of  operational  procedure.  Even  the  first  international  code 
for  liquefied  gas  carriers,  the  Code  for  Existing  Ships  Carrying  Lique¬ 
fied  Gases  in  Bulk,  included  expectations  for  loading,  testing,  and  other 
procedures. 

Liquefied  gas  carriers  built  today  are  subject  to  the  International  Code 
for  the  Construction  and  Equipment  of  Ships  Carrying  Liquefied  Gases 
in  Bulk;  the  International  Convention  on  Standards  of  Training,  Certi¬ 
fication  and  Watchkeeping  for  Seafarers;  and  other  U.S.  and  interna¬ 
tional  requirements  that  set  the  minimum  safety  culture  requirements 
for  specific  liquefied  gas  operations.  These,  in  combination  with  the  ISM 
Code,  create  the  robust  safety  management  plan  that  incorporates  all 
types  of  operations,  yet  even  with  all  these  regulations,  it  is  only  the 
start. 

One  of  the  reasons  behind  the  industry's  excellent  safety  record  is  the 
technical  and  operational  guidance  established  by  trade  organization 
industry  standards  and  company-specific  policies.  Organizations  such 
as  the  Society  of  International  Gas  Tanker  and  Terminal  Operators  share 
experiences,  address  common  problems,  and  derive  agreed  criteria  for 
best  practices  that  are  used  to  set  the  "gold  standard"  safety  culture. 


Steady  State 

Surprisingly,  most  liquefied  gases  are  not 
hazardous,  explosive,  or  environmentally 
damaging  to  the  water  or  ground  when 
spilled,  but  each  does  contain  some  unique 
safety  risks  that  must  be  acknowledged  and 
addressed.  One  of  the  most  common  chal¬ 
lenges  with  liquefied  gases  is  that  they  are, 
by  nature,  a  live  cargo — a  liquid  that  wants 
to  be  a  gas.  Therefore,  equipment  and  sys¬ 
tems  must  be  put  into  place  to  prevent  this. 

To  keep  it  in  its  liquid  state,  liquefied  gas 
must  be  under  some  combination  of  pres¬ 
surization  and/or  refrigeration.  When 
under  pressure,  the  tanks  that  store  the 
liquid  must  be  designed  to  withstand  a 
large-volume,  high-pressure  load.  When 
refrigerated,  the  tanks  must  be  designed 
to  keep  the  liquid  well  insulated.  In  some 
cases,  the  cargo  is  so  cold  that  the  tanks  and 
other  systems  that  come  into  contact  with 
the  cargo  must  use  specialized  materials  to 
withstand  cryogenic  temperatures. 

Additionally,  since  almost  all  liquefied 
gases  are  hydrocarbons,  they  are  flammable 
in  nature,  which  is  the  characteristic  that 
makes  hydrocarbons  so  valuable.  Because 
of  this,  measures  must  be  taken  to  keep 
hazardous  areas  safe  from  ignition  sources, 
monitored  for  leaks  or  fire,  and  protected  if 
a  release  or  fire  occurs. 

The  Record 

Despite  the  unique  hazards  associated  with  transporting 
liquefied  gas  and  the  public  perception  of  liquefied  gas  car¬ 
riers,  accidents  related  to  gas  carrier  cargoes  have  been  few, 
and  the  safety  record  of  liquefied  gas  carriers  is  an  acknowl¬ 
edged  industry  leader.  That  so  few  incidents  have  occurred 
demonstrates  the  success  of  the  industry's  safety  culture. 

One  case  in  point  is  the  Gaz  Fountain,  a  liquefied  natural 
gas  tanker  that  was  hit  by  three  maverick  missiles  in  1984 
during  the  first  Gulf  War  while  carrying  a  partial  load  of 
LPG.  Even  though  several  fires  penetrated  the  containment 
system,  they  were  successfully  extinguished.  The  ship  and 
most  of  the  cargo  were  salvaged.2 

Another  example  was  considered  the  worst  grounding 
accident  of  a  loaded  liquefied  gas  carrier.  The  fully  loaded 
LNG  carrier  Paul  Kayser  ran  aground  in  1979  off  the  coast 
of  Gibraltar.3  Despite  significant  bottom  damage  over  the 


whole  length  of  the  cargo  spaces  and  inner  hull  warping, 
there  was  no  loss  of  cargo  or  damage  to  the  cargo  contain¬ 
ment  system.4  These  incidents  validate  the  long-established 
safety  culture  and  robustness  in  the  design,  equipment,  pro¬ 
cedures,  and  crew  training  associated  with  liquefied  gas 
carriers. 

So  how  has  an  industry  that  carries  volatile  cargo  endured 
such  an  enviable  safety  record?  Though  the  advent  of  the 
ISM  Code  did  formalize  the  safety  culture  on  liquefied  gas 
carriers,  it  was  the  concepts  put  into  place  when  the  industry 
began  and  incremental  improvements  to  those  base  con¬ 
cepts  that  really  established  the  safety  processes  for  commu¬ 
nication,  training,  and  actions  aboard  liquefied  gas  carriers. 
The  industry  leaders  who  developed  and  constructed  the 
first  liquefied  gas  carriers  created  the  foundation,  and  sub¬ 
sequent  generations  built  more  and  more  robust  standards 
onto  these  principals  as  the  vessels  became  larger  and  more 
sophisticated. 
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The  Liquefied  Gas  Carrier  Safety  Culture 


r  Government  Regulations  > 
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Safety  Management 


Mechanical  Safeguards 


Liquefied  Gas  Hills'— 


Government  regulations,  industry  standards,  and  company  policies  set 
the  expectation  for  the  safety  culture. 


Trained  personnel  are  often  the  first  line  of  defense,  stringing  together 
the  remaining  safety  nets  to  address  potential  hazardous  situations. 
Training  requirements  detail  the  courses,  qualifications,  and 
experience  personnel  must  have  to  work  aboard  liquefied  gas  carriers. 
Personnel  aboard  are  trained  to  understand  the  cargo,  equipment, 
and  operational  and  emergency  procedures. 

Operational  and  emergency  procedures  provide  for  practices  to 
ensure  a  safe  working  environment.  They  are  the  time-tested, 
approved  recipe  for  trained  personnel  to  follow,  incorporating 
processes  for  change  to  create  continuous  improvement.  In  addition 
to  the  process  steps,  the  procedures  detail  roles,  responsibilities, 
authority,  communication,  and  reporting  for  those  involved. 

Various  mechanical  safeguards  are  installed  to  prevent,  mitigate,  and 
alert  failures.  These  types  of  safeguards  include  gas  detection;  cargo 
pressure,  temperature,  and  level  detection;  foam  and  other  fire 
extinguishing  systems;  boil-off  management  equipment;  pressure/ 
vacuum  reliefs;  inert  gas  systems;  intrinsically  safe  and  flameproof 
electrical  equipment;  and  water  spray  for  cooling  and  wash-down. 

The  containment  system  is  designed  to  protect  the  cargo  in  many 
ways.  Cargo  tanks  are  insulated  to  preserve  the  cargo's  temperature 
(and  therefore  its  pressure),  contain  multiple  barriers  and/or 
secondary  containment  systems  in  case  of  a  breach,  are  made  of 
materials  that  can  withstand  the  cryogenic  temperatures,  and  are 
constructed  to  support  sloshing  and  other  dynamic  ship  loads. 

The  liquefied  gas  itself  is,  in  some  respects,  a  safety  net. 

Understanding  the  properties  that  make  the  cargo  more  safe  vs.  more 
risky  is  important.  For  instance,  liquefied  gas  as  a  liquid  is  not 
flammable,  but  when  vaporized,  the  gas  produced  is.  There  are  many 
aspects  of  liquefied  gases  that  make  them  safer  than  some  cargoes, 
but  there  are  also  many  that  make  them  riskier. 


Figure  2:  The  Liquefied  Gas  Carrier  Safety  Culture  model  depicts  risk  mitigation  measures  as  five  distinct  safety  nets,  with  governmental  regulations,  indus¬ 
try  standards,  and  company  policies  as  its  backbone.  U.S.  Coast  Guard  graphic. 


The  Safety  Nets 

This  industry-accepted  safety  culture  that  has  evolved  relies 
on  more  than  just  design  and  equipment;  it  relies  upon  five 
distinct  safety  nets  (see  Figure  2),  with  governmental  reg¬ 
ulations,  industry  standards,  and  company  policies  as  its 
backbone.  Trained  personnel  are  the  first  line  of  defense 
to  ensure  safe  liquefied  gas  operations.  Designated  per¬ 
sonnel  string  together  all  the  risks  to  avoid  and  address 
potential  hazardous  situations.  Training  requirements 
detail  the  courses,  qualifications,  and  experience  personnel 
must  have  to  work  aboard  liquefied  gas  carriers.  Personnel 
aboard  are  trained  to  understand  the  cargo,  equipment,  and 
operational  and  emergency  procedures  in  order  to  take  the 
needed  precautions. 

The  next  safety  net  is  the  safety  management  that  ensures 
that  the  first  line  of  defense — crewmembers — follow  time- 
tested  procedures.  Safety  management  systems  are  the 
approved  "recipe"  for  designated  personnel,  with  details 


on  how  the  vessel  should  operate  in  normal  as  well  as 
emergency  situations;  how  drills  and  trainings  are  to  be 
conducted;  and  the  roles,  responsibilities,  authority,  com¬ 
munication,  and  reporting  expectations  of  the  designated 
persons.  In  addition,  these  procedures  include  processes  for 
change,  which  creates  continuous  improvement. 

As  a  third  safety  net,  various  mechanical  safeguards  pre¬ 
vent,  mitigate,  and  alert  failures,  including  gas  detection, 
cargo  pressure,  temperature,  and  level  detection  monitors; 
foam  and  other  fire  extinguishing  systems;  boil-off  manage¬ 
ment  equipment;  pressure/vacuum  reliefs;  inert  gas  sys¬ 
tems;  intrinsically  safe  and  flameproof  electrical  equipment; 
and  water  spray  for  cooling  and  wash-down. 

The  next  safety  net  involves  primary  and  secondary  con¬ 
tainment  systems  designed  to  protect  the  cargo  in  many 
ways.  For  example,  refrigerated  cargo  tanks  are  insulated  to 
preserve  the  cargo's  temperature,  and  therefore  its  pressure. 
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The  Numbers 

We  have  reached  a  record:  1,751  liquefied  gas  carriers  currently 
in  the  global  fleet;  that  number  is  expected  to  rise  to  more  than 
2,000  in  the  next  few  years;  and  358  ships  are  on  the  order 
books  as  of  late  2015. 1  These  vessels  have  increased  in  size 
from  600  cubic  meters  to  upwards  of  266,000  cubic  meters. 
This  growth  in  total  volume  is  expected  to  be  needed  to  meet 
energy  analysts'  prediction  for  future  demand. 

Experts  forecast  that  global  LNG  trade  will  double  within 
the  next  20  years.2  Additionally,  a  25  percent  increase  in  U.S. 
exports  of  liquefied  petroleum  gas  (LPG)  is  expected  in  just 
the  next  three  years.  This  includes  the  13  new  export  facilities 
within  the  Gulf  Coast  alone  that  will  triple  the  region's  capacity 
by  201 6.3 

The  U.S.  is  likely  to  top  the  LNG  and  LPG  producers  list  by  2020. 
Additional  growth  in  the  U.S.-flagged  fleet  will  come  with  LNG 
and  other  liquefied  gases  being  used  as  fuel,  including  the 
12  vessels  under  construction  or  already  in  service  domestically 
and  144  internationally. 

Endnotes: 

1  Shipping  Intelligence  Network.  Retrieved  September  1,  2015,  from  Clarksons 
Research  Services:  https://sin.clarksons.net/Register#/Fleet/Fleet/Vessel-Type. 

2  J-Y  Robin,  2014,  "An  Achievement,"  LNG  Shipping  at  50,  page  9,  found  at  www. 
sigtto.org/media/7087/lng-shipping-at-50compressed.pdf. 

3-  J.  O'Connell,  Nov.  25, 2014,  "The  Other  Gas:  While  LNG  gets  all  the  headlines,  it's 
LPG  that's  really  making  waves."  Retrieved  September  1,  2015,  from  The  Mari¬ 
time  Executive,  found  at  www.maritime-executive.com/magazine/The-Other- 
Gas-2014-11-25. 


Pressurized  cargo  systems  are  designed  to  with¬ 
stand  higher  pressures.  All  of  these  systems  are 
constructed  to  support  sloshing  and  other  dynamic 
ship  loads,  and  contain  some  type  of  secondary  con¬ 
tainment  system  in  case  of  a  breach. 

Finally,  the  most  basic  layer  of  safety  involves  rec¬ 
ognizing  the  hazards  associated  with  the  cargo 
itself.  Compared  to  other  more  commonly  carried 
cargoes,  there  are  many  other  characteristics  of  liq¬ 
uefied  gases  that  make  them  more  dangerous  in 
some  cases  and  safer  in  others.  Differentiating  what 
creates  hazards  from  what  doesn't  drives  the  need 
for  the  remaining  safety  nets.  For  example,  neither 
LNG  nor  its  natural  gas  vapors  are  toxic,  carcino¬ 
genic,  corrosive,  or  even  damaging  to  the  water 
or  ground  if  spilled.  Additionally,  liquefied  gases 
aren't  flammable  when  in  a  liquid  state.  However, 
when  vaporized,  the  gas  produced  is.  LNG  vapor  is 
also  an  asphyxiant,  displacing  the  normal  oxygen 
concentration  to  hazardous  levels  that  could  cause 
fatalities  in  certain  concentrations.  Understand¬ 
ing  such  risk  and  safety  properties  is  important  in 
developing  other  mitigation  measures. 

A  Continuing  Challenge 

While  the  industry  can  be  justifiably  proud  of  the 
exemplary  safety  record  it's  built  up  over  the  first 
half  of  the  century,  current  trends  and  changes  to 
come  within  the  industry  give  reason  to  remain 
vigilant.  The  number  and  types  of  liquefied  gas  car¬ 
riers  needed  to  support  the  nation's  "Energy  Renais¬ 
sance"  and  increased  use  of  liquefied  gas  throughout 
the  maritime  community  are  on  the  rise.  Therefore, 
it's  even  more  important  that  the  long-running  safety  cul¬ 
ture  mentality  be  preserved  and  continually  reviewed  to 
address  current  trends  and  future  operations. 

While  the  Coast  Guard  has  seen  an  increase  in  the  number 
of  liquefied  gas  carrier  arrivals,  we  have  also  seen  a  dispro¬ 
portionate  number  of  incidents  (including  near-misses)  that 
have  led  to  liquefied  gas  carrier  detentions,  due  primarily  to 
issues  within  vessel  safety  management  systems.  For  exam¬ 
ple,  a  fire  on  a  liquefied  gas  carrier  in  early  2015  was  due 
in  part  to  the  crew  not  following  its  approved  procedures, 
which  led  to  a  release  in  the  pump  room  that  came  into  con¬ 
tact  with  an  ignition  source  and  caught  fire.  Fortunately,  the 
crew  was  able  to  extinguish  the  fire  with  minimal  damage 
and  injuries. 

Additionally,  several  Coast  Guard  inspections  have  identi¬ 
fied  maintenance  gaps  with  deluge  systems  on  liquefied 


gas  carriers.  The  deluge  system  utilizes  high-velocity  water 
suppression  to  mitigate  the  risks  associated  with  liquefied 
gas  releases.  To  cover  the  hazardous  areas,  water  is  simul¬ 
taneously  diffused  through  a  specifically  designed  number 
of  sprinkler  heads.  On  more  than  one  recent  occasion,  how¬ 
ever,  the  Coast  Guard  identified  multiple  sprinkler  heads 
clogged  with  rust,  preventing  coverage  in  many  critical 
areas.  They  found  these  failures  were  caused  by  improper 
use  of  and  updates  to  maintenance  procedures. 

In  both  of  these  cases,  proper  implementation  of  the  safety 
management  system  could  have  prevented  each  incident. 

LNG  as  Fuel 

Due  to  the  environmental  and  cost  benefits  of  liquefied 
gases  —  primarily  LNG  —  some  vessel  operators  have 
decided  to  shift  to  liquefied  gases  as  a  fuel.  This  adds  another 
aspect  requiring  safety  management. 
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In  early  2015,  the  Coast  Guard  certificated  the  first  U.S.- 
flagged,  LNG-fueled  commercial  vessel.  At  the  time  they 
were  inspecting  the  construction  and  certification  of 
11  more,  from  container  ships  to  offshore  supply  vessels. 
Additionally,  there  were  144  confirmed  LNG-fueled  ves¬ 
sels  either  on  order  or  under  construction  globally — adding 
ferries,  bulkers,  tankships,  and  towing  vessels  to  the  mix. 
Even  cruise  ship  operators  were  jumping  in,  with  Carnival 
Corporation  recently  constructing  four  of  the  world's  largest 
cruise  ships,  each  LNG-powered,  carrying  6,600  passen¬ 
gers.5  In  another  example,  a  recreational  boat  builder  began 
advertising  a  series  of  12  LNG-fueled  outboard  yachts  in 
2014. 6 

As  these  new  vessels  come  online,  dependence  on  LNG 
fueling  operations  will  follow  right  behind.  Indeed,  LNG 
bunkering  services  are  already  beginning  to  appear  in  ports 
around  the  world.  While  these  vessels  and  fueling  opera¬ 
tions  currently  seem  to  be  mirroring  the  safety  culture  found 
throughout  the  liquefied  gas  carrier  industry,  some  wonder 
if  the  fueling  operations  will  keep  the  same  approach  in  the 
long  run.  As  fueling  operations  become  more  abundant, 
competition  will  ensue,  which  may  put  financial  pressure 
on  operators  —  some  relatively  small-scale,  with  less  back¬ 
ing  than  the  liquefied  gas  carrier  industry.  As  more  and 
more  operators  enter  the  market  and  the  pool  becomes  more 
diverse,  some  may  no  longer  value  or  even  recognize  the 
unique  hazards  these  new  fuels  present  until  it's  too  late. 

Finally,  what  was  once  an  industry  of  purpose-built  lique¬ 
fied  gas  carriers  designed  for  specific  facilities  will  soon 
welcome  multipurpose  vessels  that  need  to  go  wherever  and 
whenever.  Each  of  the  concerns  mentioned  increases  the  risk 
of  incident  for  the  industry  as  a  whole.  To  help  ensure  there's 
guidance  out  there  for  vessel  and  fueling  operators,  organi¬ 
zations  such  as  the  Society  For  Gas  as  a  Marine  Fuel  have 
recently  been  established  to  promote  safety  and  industry 
best  practices  in  the  use  of  gas  as  a  marine  fuel. 

Additionally,  the  Coast  Guard  has  released  four  policy  let¬ 
ters7  associated  with  LNG-fueled  vessels  and  associated 
bunkering  operations,  and  the  IMO  recently  adopted  the 
first-ever  International  Code  of  Safety  for  Ships  using  Gases 
or  other  Low-flashpoint  Fuels  to  minimize  risk  to  a  ship,  its 
crew,  and  the  environment.8 

As  stricter  emissions  regulations  and  cost  benefits  make 
LNG  an  obvious  choice,  the  U.S.  will  see  more  and  more  use 
of  these  types  of  maritime  fuels,  and  the  associated  bun¬ 
kering  services  to  support  this  new  domestic  and  foreign 


need  will  create  new  operations  in  almost  every  port.  As 
these  predictions  unfold,  new  challenges  will  surface  that 
the  industry,  trade  organizations,  and  regulators  will  need 
to  consider.  If  this  aspect  of  the  industry  expects  to  emulate 
the  excellent  safety  record  of  liquefied  gas  carriers,  it  must 
hold  itself  to  the  same  safety  culture  standards. 

It  will  be  paramount  that  the  industry  as  a  whole — from 
large-scale  liquefied  gas  carriers  to  small  LNG-fueled  harbor 
tugs — ensures  its  focus  on  all  aspects  of  safety,  an  adequate 
supply  of  properly  trained  and  competent  personnel,  and 
the  process  of  continuously  assessing  safety  procedures. 
Maintaining  this  "gold  standard"  safety  culture  across  the 
industry  will  be  similarly  paramount  to  consistently  ensure 
the  safe  maritime  transportation  and  use  of  liquefied  gas. 
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Gases  in  Bulk  (IGC  Code),  1993  Edition. 
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Carry/ Gas%20matters.pdf. 

3-  Global  Security,  July  7, 2011.  Retrieved  September  1, 2015,  from  LNG  Tanker  Safety, 
found  at  www.globalsecurity.org/military/ systems/ ship/ tanker-lng-safety.htm. 

4-  S.  Mokhatab,  J.Y.  Mak,  J.V.  Valappil,  and  D.  A.  Wood,  Handbook  of  Liquefied  Natu¬ 
ral  Gas,  2014.  Oxford:  Gulf  Professional  Publishing. 
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Retrieved  September  1,  2015,  from  Maritime  Executive,  found  at  http://maritime- 
executive.com/article/carnival-orders-worlds-first-lng-powered-cruise-ships. 

6-  "Intrepid  to  Debut  Natural  Gas  Hybrid  Boat  In  Fort  Lauderdale,"  October  21, 2014. 
Retrieved  September  1, 2015,  from  Boating  Magazine,  found  at  www.boatingmag. 
com/boats/intrepid-to-debut-natural-gas-hybrid-boat-fort-lauderdale. 

7  The  four  policy  letters  are  as  follows: 

CG-521  Policy  Letter  No  01-12  -  Equivalency  Determination  -  Design  Criteria  for 
Natural  Gas  Fuel  Systems,  US  incorporation  of  Interim  IGF  Code  plus  additional 
design  criteria  for  US  vessels,  found  at  https://www.uscg.mil/hq/cg5/cg521/ 
docs/CG-521.PolicyLetter.01-12.pdf. 

CG-OES  Policy  Letter  No  01-15  -  Guidelines  for  Liquefied  Natural  Gas  Fuel 
Transfer  Operations  and  Training  of  Personnel  on  Vessels  Using  Natural  Gas 
as  Fuel,  Operational  criteria  for  LNG  fueled  vessels  plus  training  expectations, 
found  at  www.uscg.mil/hq/cg5/lgcncoe/docs/LNGF%20Policy%20LTR.pdf. 
CG-OES  Policy  Letter  No.  02-15  -  Guidance  Related  to  Vessels  and  Waterfront 
Facilities  Conducting  Liquefied  Natural  Gas  (LNG)  Marine  Fuel  Transfer  (Bun¬ 
kering)  Operations,  Operational  criteria  for  LNG  bunkering  facilities  (127  regs 
tailored  for  bunkering  only  facilities),  found  at  www.uscg.mil/hq/cg5/lgcncoe/ 
docs/Bunking%20Policy%20LTR.pdf. 

CG-ENG  Policy  Letter  No  02-15  -  Design  Standards  for  US  Barges  Intending  to 
Carry  Liquefied  Natural  Gas  in  Bulk,  US  criteria  for  LNG  barges  (154  regs  tai¬ 
lored  for  barges),  found  at  https://www.uscg.mil/hq/cg5/cg521/docs/CG-ENG. 
PolicyLetter.02-15.pdf. 

8-  International  Maritime  Organization,  June  26,  2015.  Retrieved  September  1,  2015, 
from  Maritime  Safety  Committee  (MSC),  95th  session,  3-12  June  2015,  found  at 
www.imo.org/en/MediaCentre/PressBriefings/Pages/26-MSC-95-ENDS.aspx. 
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Vessel  Inspections 


Making  the  Safe,  Safer 

Implementing  safety  management  systems 
on  domestic  passenger  vessels. 


by  Mr.  Eric  P.  Christensen 
Director  of  Regulatory  Affairs  and  Risk  Management 
Passenger  Vessel  Association 


Today's  U.S.-flagged  domestic  passenger  vessel  industry 
is  one  of  the  safest  modes  of  transportation  in  the  United 
States.  This  is  a  testament  to  the  professionalism  of  vessel 
operators  as  well  as  their  commitment  to  maintaining  a  con¬ 
sistently  high  standard  of  safety  for  passengers  and  crew. 

Though  no  injury  or  fatality  is  acceptable,  this  industry 
record  is  particularly  significant,  especially  when  you 
consider  that  according  to  the  Passenger  Vessel  Associa¬ 
tion  (PVA),  the  U.S.  passenger  vessel  industry  safely  car¬ 
ries  more  than  200  million  passengers  each  year.  How  did 
the  passenger  vessel  industry  develop  such  a  record?  The 
answer  is  simple — through  broad  recognition  across  all  U.S. 
passenger  vessel  industry  segments  regarding  the  impor¬ 
tance  of  safety,  developing  safety  and  training  programs 
that  work,  and  creating  an  atmosphere  where  all  employees 
work  toward  a  common  safety  goal. 


In  the  world  of  safety  management,  one  must  never  become 
complacent  or  satisfied  with  the  status  quo.  Accidents  will 
happen,  so  it's  imperative  to  keep  moving  forward  with 
safety-related  activities  and  programs  that  will  deliver  ever- 
improving  results.  Along  these  lines,  and  in  an  effort  to  go 
beyond  regulatory  compliance,  reduce  risk,  and  seek  con¬ 
tinuous  improvement,  the  PVA  has  worked  to  develop  a 
voluntary  safety  management  system  (SMS)  program  called 
"Flagship,"  which  is  tailored  especially  to  passenger  vessel 
operators  and  scalable  to  operations  of  all  sizes.  The  goal  is 
to  achieve  an  enhanced  level  of  safety  and  environmental 
compliance  through  a  proactive  culture  of  continuous  pro¬ 
cess  improvement. 

Why  Look  at  Safety  Management  Systems? 

There's  no  denying  that  any  incident  garnering  media  atten¬ 
tion  on  a  vessel  shakes  up  public  opinion  of  the  passenger 


What  is  a  Safety  Management  System? 


A  safety  management  system  is  a  structured  and  docu¬ 
mented  system  enabling  shoreside  and  vessel  personnel  to 
effectively  implement  company  safety  and  environmental 
protection  policies.  It  is  a  coordinated,  comprehensive  set  of 
processes  that  help  a  company  to  most  efficiently  and  effec¬ 
tively  manage  safety  and  environmental  operations. 

A  safety  management  system  combines  management 
processes  into  one  cohesive  structure  to  achieve  an  enhanced 
level  of  safety  and  environmental  compliance  through  a 
proactive  culture  of  continual  process  improvement.  A  safety 
management  system  must  contain  the  following  functional 
standards  and  performance  elements: 


a  safety  and  environmental  protection  policy; 

l/  instruction  and  procedures  to  ensure  safe  operation 
of  the  vessels  and  protection  of  the  environment,  in 
compliance  with  relevant  rules  and  regulations; 

l/  defined  levels  of  authority  and  defined  lines  of  communi¬ 
cation  between  and  among  shore  and  vessel  personnel; 

procedures  for  reporting  accidents  and  nonconformi¬ 
ties; 

1/  procedures  to  prepare  for  and  respond  to  emergencies; 
and 

%/  procedures  for  internal  audits  and  management 
reviews. 
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The  unique,  diverse  nature  of  the  domestic  passenger  vessel  industry  requires  safety  management  systems  that  are  equally  unique, 
scalable,  and  appropriate  to  diverse  types  of  operations. 


vessel  industry.  The  incident  need  not  even  be  domestic,  as 
was  evidenced  following  the  sinking  of  the  Korean  ferry 
M/ V  Sewol  in  April  2014  with  the  loss  of  more  than  300  pas¬ 
sengers,  mostly  children.1  The  PVA  staff  received  numerous 
requests  for  comment  regarding  the  incident,  including  the 
question  "Can  it  happen  here?" 

Casualty  statistics  analyses  conclude  that  more  than  80  per¬ 
cent  of  all  high-consequence  marine  casualties  are  directly  or 
indirectly  attributable  to  "the  human  element."2  These  types 
of  errors  play  a  part  in  virtually  every  casualty — including 
those  where  structural  or  equipment  failure  may  be  deemed 
the  apparent  cause. 

The  National  Transportation  Safety  Board  has  endorsed 
adopting  safety  management  systems  as  a  means  to  enhance 
transportation  safety  in  the  nation's  domestic  ferry  systems. 
Several  ferry  systems  are  currently  operating  with  a  safety 


management  system  in  place,  and  have  already  experienced 
direct  and  indirect  benefits  as  a  result. 

For  example,  a  safety  management  system  prompts  vessel 
operators  to  go  beyond  looking  at  accidents  and  incidents, 
analyzing  more  broadly  to  also  address  nonconformities 
found  during  routine  maintenance  and  inspection.  By 
identifying  issues  and  potential  problems  impacting  ves¬ 
sel  operations,  the  vessel  operator  can  make  repairs  or  put 
procedures  in  place  to  mitigate  identified  risks. 

The  Regulatory  Seascape 

Currently,  U.S.  vessels  engaged  on  foreign  voyages  and 
subject  to  the  International  Convention  for  the  Safety  of 
Life  at  Sea  (SOLAS)  must  comply  with  the  International 
Safety  Management  (ISM)  Code.  For  passenger  vessels, 
the  ISM  Code  is  currently  only  mandatory  for  those  car¬ 
rying  more  than  12  passengers  on  an  international  route. 
In  1997,  the  Coast  Guard  established  an  equivalent  to  ISM 
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Who  is  This  Elephant, 
and  Why  is  He  in  the  Room? 

While  voluntary  compliance  is  a  goal  —  and  we  should  strive  for  it  and 
show  the  public  that  Passenger  Vessel  Association  (PVA)  members 
take  safety  and  environmental  stewardship  seriously  —  there's  no 
denying  that  federal  requirements  are  looming  on  the  horizon. 

The  2010  Coast  Guard  Authorization  Act  called  for  the  Coast  Guard 
to  develop  regulations  requiring  safety  management  systems  on 
passenger  vessels.  That  process  is  underway,  but  regulations  take 
time. 

While  the  Coast  Guard  doesn't  need  to  reinvent  the  wheel  regarding 
the  elements  of  a  safety  management  system,  what  it  will  need  is 
the  industry's  input.  Through  the  notice  and  comment  process  of 
rulemaking,  the  industry  can  suggest  how  best  to  implement  safety 
management  systems  in  an  industry  with  an  enviable  safety  record.  If 
the  PVA  can  show  a  model  path  to  compliance  through  our  voluntary 
safety  management  system,  "Flagship,"  without  overburdening  our 
members,  then  we  stand  a  good  chance  of  influencing  the  regulatory 
outcome  for  the  benefit  of  all. 


Code  compliance  for  small  passenger  vessels  cer¬ 
tificated  under  46  Code  of  Federal  Regulations, 
Subchapter  T. 

There  are,  of  course,  an  entire  group  of  U.S.  pas¬ 
senger  vessels  that  are  not  subject  to  SOLAS; 
therefore,  they  are  not  required  to  comply  with 
the  ISM  Code.  The  Coast  Guard  has  long  sought 
to  encourage  voluntary  compliance  with  the 
safety  management  system  requirements  of  the 
ISM  Code  to  the  maximum  extent  possible  on 
these  domestic  vessels. 

Most  recently.  Section  610  of  the  Coast  Guard 
Authorization  Act  of  2010  amended  Section  3202 
of  Title  46  U.S.  Code  to  include  passenger  and 
small  passenger  vessels  with  other  vessels  requir¬ 
ing  a  safety  management  system.  However,  there 
were  no  thresholds  (passenger  capacity,  inspec¬ 
tion  subchapter,  etc.)  specified  in  the  amended 
law.  That's  where  the  PVA  Flagship  initiative 
comes  into  play. 

Flagship 

Flagship  is  a  safety  management  system  appro¬ 
priate  and  scalable  for  the  domestic  passenger 
vessel  industry.  While  it  does  provide  structure,  it's  also 
designed  to  be  flexible  enough  to  readily  capture  typical 
passenger  vessel  procedures  and  processes,  document 
compliance  with  all  applicable  laws  and  regulations,  iden¬ 
tify  nonconformities  for  corrective  action  and  continuous 
improvement,  and  establish  a  program  of  audits. 

In  the  name  of  enhancing  regulatory  compliance  and  safety 
on  domestic  passenger  vessels.  Flagship's  goals  are  to  pro¬ 
vide  PVA  members  with  a  program  template,  providing 
guidance  to  implement  programs  in  a  way  that  the  Coast 
Guard  will  recognize  and  accept. 

To  develop  Flagship,  a  chartered  working  group  of  PVA 
members  and  Coast  Guard  participants  harvested  best 
practices  by  reviewing  existing  public  and  private  sector 
practices  and  processes  for  maintenance,  management,  and 
internal  reporting  systems.  The  working  group  also  took  the 
existing  ISM  Code  template  that  the  Coast  Guard  developed 
for  small  passenger  vessels  on  international  voyages  and 
modified  it  to  meet  domestic  requirements. 

Observations  So  Far 

Ten  Passenger  Vessel  Association  member  companies  are 
currently  beta  testing  the  draft  Flagship  code  and  guidelines 
the  PVA/Coast  Guard  working  group  developed.  A  safety 
management  system  is  iterative  by  design,  and  the  more  the 


beta  test  companies  work  with  the  code  and  guidelines,  the 
more  refined  the  system  will  become. 

Further,  while  accident  reporting  is  (arguably)  clear  in 
regulations,  tracking  and  acting  upon  incidents  that  aren't 
defined  as  casualties  but  could  still  impact  personnel  and 
property  is  a  work  in  progress.  Another  area  not  yet  fully 
developed  is  the  role  of  internal  and  external  audits  of  com¬ 
pany  operations. 

There  are  a  number  of  members  within  the  association  that 
have  already  implemented  a  safety  management  system. 
Some  have  done  so  due  to  regulatory  mandates  associated 
with  international  operations,  while  others  have  found 
that  a  proactive  system  of  continuous  improvement  leads 
to  reduced  accidents,  greater  vessel  availability,  and  more 
widespread  crew  commitment  to  operate  in  a  safe  and  envi¬ 
ronmentally  sound  manner.  The  level  of  interest  in  Flagship 
within  PVA  has  dramatically  increased  as  a  result  of  having 
these  experienced  members  share  their  safety  management 
system  experience  with  other  members. 

Moving  Forward 

As  more  PVA  members  embrace  Flagship  and  safety  man¬ 
agement  systems  in  general.  Coast  Guard  engagement,  com¬ 
mitment,  and  approval  will  be  key  to  our  success.  We  have 
already  experienced  their  engagement  through  the  quality 
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partnership  and  Flagship  working  group.  Coast  Guard  com¬ 
mitment  and  approval  will  come  as  leadership  establishes 
policies  and  procedures  to  recognize  voluntary  compliance, 
then  train  marine  inspection  personnel  in  the  practice  of 
auditing.  Passenger  Vessel  Association  members  welcome 
Coast  Guard  involvement  in  conducting  external  audits  on 
Flagship  vessels  and  companies,  as  without  the  involvement 
and  buy-in  from  local  sector  personnel,  company  commit¬ 
ment  could  wane  under  a  cloud  of  indifference. 

We  understand  that  safety  management  systems  are  not  a 
replacement  for  inspection;  however,  effective  implementa¬ 
tion  should  allow  for  increased  intervals  between  inspec¬ 
tions  and  a  reduced  scope  of  inspection  during  the  validity 
of  a  certificate  of  inspection.  Such  incentives  should  be  part 
of  any  future  rulemaking  to  add  benefit  to  the  regulatory 


cost/benefit  analysis  and  to  recognize  the  trust  the  Coast 
Guard  is  willing  to  put  into  vessel  operators  who  demon¬ 
strate  a  higher  commitment  to  safety. 
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-  For  more  information: 

The  Passenger  Vessel  Association  (PVA) 
is  the  national  trade  association  for  U.S.- 
flagged  passenger  vessels  of  all  types.  The 
PVA  has  more  than  500  vessel  and  associate 
members  who  own  and  operate  passenger 
and  vehicular  ferries,  dinner  cruise  vessels, 
sightseeing  and  excursion  vessels,  private 
charter  vessels,  whale-watching  and  eco- 
tour  operators,  windjammers,  gaming 
vessels,  amphibious  vessels,  water  taxis,  and 
domestic  overnight  cruise  ships. 

For  more  information,  go  to:  www. 
passengervessel.com. 
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One  System 

Connecting  SMS  requirements  to  vessel  operations. 


by  LT  Josh  Buck 
Investigating  Officer 
U.S.  Coast  Guard  Sector  New  York 


The  International  Maritime  Organization  (IMO)  developed 
the  International  Safety  Management  (ISM)  Code,  which 
requires  all  ships  to  maintain  a  safety  management  system 
(SMS).  However,  in  my  experience  as  a  U.S.  Coast  Guard 
marine  inspector,  quality  management  auditor,  and  inves¬ 
tigating  officer,  I  have  noticed  some  detachment  between 
documented  management  systems  and  actual  operations. 

In  fact,  the  IMO  found  that  the  administrative  burden  for 
safety  management  systems  was  an  issue  regarding  SMS 
use  and  implementation,  according  to  a  2005  study,1  and 
a  2013  vessel  collision  study  found  that  SMS-related  non- 
compliance  and  human  error  were  the  two  main  causal 
factors  for  the  collisions.2  Thus,  when  safety  management 
systems  aren't  connected  well  to  actual  operations  on  a  ves¬ 
sel,  human  error  may  be  more  likely  to  occur. 

While  the  ISM  Code  is  still  a  critical  component  of  support¬ 
ing  safe  vessel  operations,  it's  clear  that  safety  management 
systems  may  not  connect  to  vessel  operations  as  well  as 
they  should.  While  it's  important  for  a  vessel's  operations 
to  conform  to  the  ISM  Code  and  have  an  inherent  SMS,  in 
my  opinion,  the  safety  management  system  need  not  be  a 
separate  system. 

Conforming  to  the  ISM  Code 

In  2002,  it  became  mandatory  for  each  company  operating 
ships  applicable  to  the  ISM  Code  to  develop  and  maintain 
safety  management  systems  for  its  vessels.  The  objectives  of 
the  ISM  Code,  particularly  within  the  marine  environment, 
are  to: 

•  ensure  safety  at  sea, 

•  prevent  human  injury  or  loss  of  life,  and 

•  avoid  damage  to  the  environment.3 

In  essence,  the  ISM  Code  seeks  to  protect  all  stakehold¬ 
ers  within  the  world's  maritime  transportation  system.  Its 
objectives  align  directly  with  a  vessel's  adherence  to  existing 
IMO  requirements. 


However,  it  creates  some  confusion  when  the  ISM  Code 
appears  to  mandate  creating  a  separate  safety  system 
within  a  company,  and,  consequently,  aboard  a  vessel.  For 
example,  why  does  a  vessel  need  to  maintain  a  safety  man¬ 
agement  system  when  the  functional  requirements  of  ISM 
Code  clause  1.4  (such  as  overarching  safety,  environmen¬ 
tal,  emergency,  communication,  and  management  policies) 
should  already  be  a  part  of  the  vessel's  operational  system 
as  a  result  of  other  requirements?  A  company  SMS  should 
already  be  built  into  a  vessel's  existing  procedures,  process, 
and  operations. 

This  is  similar  to  the  process  in  which  manufacturing  com¬ 
panies  become  ISO  9001  certified  through  implementing  a 
separate  quality  management  system  (QMS).  Manufactur¬ 
ing  companies  don't  need  to  implement  a  QMS,  but  rather 
ensure  their  system  conforms  to  the  QMS  standard.  Ves¬ 
sels  and  their  parent  companies  don't  need  to  maintain  a 
separate  system  for  safety  management  when  that  safety 
management  should  already  be  a  part  of  a  company's  and 
vessel's  operational  system. 

I  relate  it  to  asking  a  vessel  master,  "May  I  see  your  regula¬ 
tory  compliance  system  manual?"  Why  would  a  separate 
regulatory  compliance  system  need  to  exist?  The  bottom 
line  is  that  vessels  and  companies  do  not  need  to  create  a 
new  and  separate  safety  management  system  when  they  can 
incorporate  their  existing  systems,  procedures,  and  manu¬ 
als  into  a  safety  management  system  to  comply  with  the 
required  standard. 

A  System-Based  Perspective 

A  commercial  vessel's  main  objective  is  to  transport  cargo  or 
passengers  from  point  A  to  point  B  safely,  in  a  timely  man¬ 
ner,  and  with  minimal  impact  to  the  marine  environment. 
To  facilitate  this,  commercial  vessel  crews  have  regulations, 
company  policies,  drills,  safety  management  systems,  bridge 
resource  management  systems,  plans,  procedures,  and  a 
plethora  of  other  safeguards  to  follow,  meet,  or  implement. 
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Similar  Requirements 


SMS-related  deficiencies  —  they 
should  be  one  and  the  same. 


International  Safety  Management 
(ISM)  Code  Requirement 

International  Ship  and  Port  Security 
(ISPS)  Code  Requirement 

Clause  9 —  Reports  and  analysis  of 
nonconformities,  accidents,  and 
hazardous  occurrences 

Clauses  11.2.7  and  12.2.5  —  Company 
and  ship  security  officer  reporting 
requirements 

Clause  10 — Maintenance  of  the  ship 
and  equipment 

Clauses  9.4.15  and  9.4.16  —  Ship 
security  plan 

Clause  11  — Documentation 

Clause  10 — Records 

Clause  12  —  Company  verification, 
review,  and  evaluation 

Clause  9  (numerous  cites)  —  Ship 
security  plan 

While  meeting  this  overall  objective,  a  vessel's  operational 
system  should: 

•  conform  to  ISM  Code  requirements,  thus  becoming  a 
safety  management  system; 

•  connect  all  vital  vessel  systems,  from  the  keel  to  the 
master  captaining  the  ship; 

•  include  all  the  aforementioned  safeguards. 

The  addition  of  a  separate  SMS  documentation  system  seems 
burdensome — disconnected  from  the  crew,  port  engineers, 
and  other  stakeholders. 

A  separate  documentation  system  is  beneficial  for  auditors 
and  inspectors,  but  how  beneficial  is  a  safety  management 
system  for  the  actual  vessel  operators?  I  relate  this  closely 
to  my  quality  management  system  research  and  experience, 
where  an  organization  may  have  an  actual  production  sys¬ 
tem  but  also  maintains  a  QMS  with  its  own  documentation 
control,  procedures,  and  processes  distinct  from  the  actual 
operations  of  the  organization.  Often  a  QMS  or  SMS  is  imple¬ 
mented  just  so  a  company  can  market  that  they  have  one. 

The  key  is  the  overall  objective  and  performance  expectation 
clarity  —  not  necessarily  whether  enough  documentation 
exists  to  support  a  safety  management  system.  Expectation 
and  mission  clarity  is  essential  for  any  system  to  operate 
effectively.  This  is  no  different  for  vessel  operations,  where 
operational  systems  should  connect  to  and  be  a  subsystem 
of  an  overarching  company  system. 

The  ISM  Code  appears  to  imply  a  need  for  additional  pro¬ 
cesses  or  procedures.  For  example,  clause  5  of  the  ISM  Code 
requires  vessel  masters  to  review  their  company's  safety 
management  system  and  report  any  deficiencies  back  to  the 
vessel's  company  management,4  implying  that  the  SMS  is 
distinct  and  separate  from  vessel  operations.  This  can  be 
confusing,  considering  that  all  the  vessel  master  really  needs 
to  do  is  report  any  deficiencies  regarding  a  vessel's  opera¬ 
tional  system,  not  vessel-related  deficiencies  and  specific 


Does  a  master  need  to  report  an  engine 
deficiency  and  also  document  a  safety 
management  system  deficiency  for  the 
same  issue  separately?  Isn't  clause  5 
met  any  time  a  vessel  master  reports 
to  shoreside  management  regarding 
any  deficiency  occurring  in  a  vessel's 
operation  system?  Do  safety  manage¬ 
ment  system  manuals,  procedures, 
checklists,  and  other  documentation 
need  to  exist  for  companies  and  ves¬ 
sels  to  meet  the  ISM  Code? 

One  System 

I  understand  requiring  that  a  safety  management  system 
exist,  in  part,  for  a  company's  external  stakeholders  to  con¬ 
nect  vessel  operational  systems  to  company  processes. 
However,  consensus  standards  like  the  ISM  Code  are  much 
more  manager-  and  process-focused  than  employee-centric. 
A  company's  SMS  needs  to  be  less  emblematic,  and  more 
focused  on  employees — in  this  context,  the  mariners — who 
can  make  vessel  operations  safer.5  Mariners  and  vessels  are 
the  safety  management  system. 

In  a  real-life  example,  I  investigated  one  incident  where  a 
vessel  captain  hadn't  followed  company  policy  regarding 
emergency  notifications.  However,  the  company  admit¬ 
tedly  never  provided  the  emergency  notification  informa¬ 
tion  to  the  masters;  the  procedure  was  in  a  lengthy  company 
document  not  readily  available.  To  make  it  "one  system," 
the  company  could  have  provided  the  master  a  checklist 
to  follow  when  an  emergency  occurred.  Then  the  master 
wouldn't  necessarily  need  to  know  the  policy,  but  still  could 
have  followed  it  because  the  system  connected  the  shoreside 
office  to  vessel  operations. 

In  summary,  what  good  is  a  safety  management  system 
if  mariners  are  not  really  engaged  with  it?  When  SMS  non- 
compliance  is  noted  after  a  casualty,  it  may  behoove  an 
investigator  to  assess  whether  the  given  safety  manage¬ 
ment  system  was  embedded  into  the  actual  vessel  opera¬ 
tions —  and  ultimately,  into  the  practices  of  the  mariners 
doing  the  work. 

The  IMO  study  regarding  ISM  Code  implementation6  rec¬ 
ommended: 

•  involving  seafarers  in  developing  and  continuously 
improving  ISM  manuals; 

•  streamlining  and  reducing  the  paperwork  supporting 
ISM  compliance,  particularly  the  SMS; 
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•  identifying  common  areas  of  the  ISM  Code  and  the 
International  Ship  and  Port  Security  (ISPS)  Code  and 
integrating  documentary  requirements. 

I  think  these  recommendations  are  still  appropriate  today. 
For  example,  the  ISM  and  International  Ship  and  Port  Secu¬ 
rity  (ISPS)  Code  both  appear  to  require  separate  systems, 
plans,  and  procedures,  as  the  ISPS  Code  requires  a  ship 
security  plan,7  while  the  ISM  Code  requires  a  safety  man¬ 
agement  system.  These  requirements  could  be  met  through 
a  holistic  company  and  vessel  operations  manual.  Even  fur¬ 
ther,  the  ISPS  Code  and  ISM  Code  require  procedures  for 
reporting  and  recommending  improvements,  which  could 
be  combined  within  one  company  system. 

Duplication  of  effort  in  any  system  leads  to  waste.  A  com¬ 
pany  could  maintain  one  standard  operations  manual  that 
addresses  appropriate  requirements  from  both  the  ISM 
and  ISPS  Codes,  which  would  serve  as  a  safety  manage¬ 
ment  system.  When  all  components  of  a  system  are  running 
smoothly  and  efficiently,  there's  no  need  for  "separate"  sys¬ 
tems.  Could  you  imagine  a  company  trying  to  implement  a 
quality  management  system,  safety  management  system, 
and  security  system?  That  doesn't  seem  beneficial  to  me. 
Companies  operating  vessels  need  to  have  one  system  that 
conforms  to  applicable  codes  and  standards — one  system  to 
rule  them  all  and  serve  as  the  SMS. 

Auditing  One  System 

The  next  question  is  how  to  monitor  and  improve  a  system. 
In  my  experience,  auditors  typically  verify  how  well  a  sys¬ 
tem  conforms  to  the  ISM  Code  (in  addition  to  many  other 
standards)  by  spending  the  majority  of  their  time  reviewing 
documentation,  processes,  and  procedures.  I've  found  that 
minimal  time  is  spent  observing  actual  operations. 

What  may  be  more  beneficial  are  observatory  audits,  where 
auditors  observe  actual  operations  to  ascertain  why  employ¬ 
ees  do  certain  things,  then  work  to  discover  ways  to  improve 


operations.  The  commercial  airline  industry  already  uses 
this  process.  These  observatory  audits  produce  a  valid  pic¬ 
ture  of  operations,  and  in  vessel  operations  the  audits  could 
identify  gaps  between  ambitious  company  safety  manage¬ 
ment  system  requirements  and  real-life  vessel  operations.8 

The  observatory  audits  may  allow  mariners  to  provide  bet¬ 
ter  feedback  to  company  personnel  managing  vessel  opera¬ 
tions.  For  example,  rather  than  review  documentation  that 
proves  employees  submitted  corrective  actions,  an  audi¬ 
tor  would  experience  the  mariner  submitting  a  corrective 
action  report,  noting  any  impedance  in  the  process.  Obser¬ 
vatory  audits  could  pave  a  way  for  many  companies  to  shed 
unwanted  documentation  and  connect  the  dots — all  in  one 
system. 
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8-  C.  Chauvin,  S.  Lardjane,  G.  Morel,  J.  Clostermann,  &  B.  Langard,  "Human  and 
organizational  factors  in  maritime  accidents:  Analysis  of  collisions  at  sea  using 
the  HFACS,"  2012.  Accident  Analysis  and  Prevention,  59,  26-37.  doi:10.1016/j. 
aap.2013.05.006. 
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USCG  Mission  Management  System 


The  IMO  Mandatory  Member 
State  Audit  Program 

Appraising  the  flag. 


by  Mr.  John  J.  Hannon 
Office  of  Commercial  Vessel  Compliance 
Domestic  Vessel  Compliance  Division 
U.S.  Coast  Guard 


On  January  1,  2016,  the  International  Maritime  Organiza¬ 
tion  (IMO)  implemented  a  mandatory  system  of  audits  for 
its  170  member  states  to  verify  the  degree  to  which  each 
member  state  effectively  implements  the  mandatory  IMO 
instruments  to  which  it  is  signatory.1  This  mandatory  pro¬ 
gram  follows  a  successful  voluntary  program  that  ran  from 
2006  to  2015,  in  which  the  United  States  and  approximately 
70  other  member  states  participated.  Going  forward  with 
the  mandatory  system,  experienced  government  maritime 
authority  personnel  from  the  IMO  member  states  will  con¬ 
duct  these  mandatory  audits,  and  the  London,  U.K.,  Inter¬ 
national  Maritime  Organization  staff  will  support  these 
volunteer  auditors  to  ensure  audit  program  continuity  and 
consistency. 

The  audits  will  highlight  areas  where  IMO  member  states 
demonstrate  exceptional  competence  in  implementing  the 
IMO  instruments  and  note  areas  where  further  develop¬ 
ment  is  needed  to  achieve  full,  effective  implementation. 
The  member  states  that  did  not  participate  in  the  voluntary 
program  are  first  in  line  to  be  audited,  followed  by  those  that 
participated  in  the  voluntary  audits.2 

Triple  I 

The  audit  standard  comes  from  the  International  Maritime 
Organization  Code  for  the  Implementation  of  IMO  Instru¬ 
ments  (referred  to  as  the  "triple  I"  or  "III"  Code).3  As  such, 
the  audits  focus  on  maritime  safety  and  environmental 
protection  programs;  maritime  security  programs  aren't 
included  in  the  audit  scheme. 

Each  member  state  will  have  access  to  a  summary  of  the 
audit  findings,  including  any  observations  and  noncon¬ 
formances,  but  without  attribution  to  the  member  states 
involved.  The  full  audit  report  will  only  be  available  to  the 


auditors  and  the  audited  member  state  unless  the  mem¬ 
ber  state  voluntarily  elects  to  make  the  report  public.  For 
example,  the  U.S.,  among  many  other  nations,  has  chosen  to 
make  public  the  full  IMO  voluntary  audit  report. 

The  member  state  must  submit  a  corrective  action  plan  to 
the  International  Maritime  Organization  for  all  nonconfor¬ 
mances  in  the  audit  report,  but  the  IMO  won't  make  those 
corrective  actions  available  to  other  member  states. 

The  International  Maritime  Organization  subcommittee 
for  Implementation  of  Mandatory  IMO  Instruments  (also 
known  as  the  III  subcommittee)  has  a  standing  work  group 
that  annually  evaluates  the  findings  to  examine  areas  where 
the  IMO  could  improve  instrument  implementation.  The  III 
subcommittee  may  make  recommendations  to  the  parent 
IMO  committees  for  additions,  deletions,  or  amendments  to 
one  or  more  of  the  IMO  mandatory  instruments  if  the  audit 
findings  reveal  that  some  provision  has  proven  problematic 
when  it  comes  to  effective  implementation. 

The  main  areas  of  the  audit  are: 

•  common  areas, 

•  flag  states, 

•  port  states,  and 

•  coastal  states. 

The  applicability  of  these  sections  varies  from  country  to 
country,  depending  on  the  geographical  location  of  the 
member  state  and  organization.  For  example,  some  IMO 
member  states  are  landlocked,  with  no  sea  ports  or  coastline 
whatsoever.  However,  these  member  states  register  ships 
under  their  flag,  and  therefore,  have  responsibility  to  imple¬ 
ment  the  IMO  instruments  that  apply  to  those  ships.  So,  in 
such  an  instance,  the  audit  would  omit  the  port  state  and 
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Captain  Lonnie  Harrison  (6th  from  the  left),  USCG,  and  his  team  of  IMO  auditors  (4th  and  8th  from  the 
left)  pause  during  a  voluntary  IMO  member  state  audit  of  Ireland.  U.S.  Coast  Guard  photo  courtesy  of 
CAPT  Lonnie  Harrison. 


coastal  state  areas,  focusing  only  on  the 
common  and  flag  state  areas. 

Common  Areas 

As  the  name  implies,  "common  area" 
requirements  apply  to  all  member 
states,  regardless  of  location  and  fleet 
composition.  The  focus  is  on  orga¬ 
nization,  resources,  and  planning  to 
ensure  that  international  obligations 
and  responsibilities  as  a  flag,  port,  and 
coastal  state  are  met.  The  III  Code  notes 
that  each  state  should  also  monitor  and 
assess  effective  implementation  and 
enforcement  for  relevant  international 
mandatory  instruments,  and  should  continuously  review 
its  strategy  to  maintain  and  improve  overall  organizational 
performance  and  capability  as  a  flag,  port,  and  coastal  state. 

An  example  of  a  common  area  for  all  member  states  is 
enacting  national  laws  and  regulations.  Every  IMO  mem¬ 
ber  state  must  give  force  to  the  mandatory  IMO  instruments 
to  which  it  is  signatory  via  its  national  laws,  regulations, 
policy,  and  procedures.  Depending  on  the  legislative  and 
administrative  structure  of  each  member  state,  this  can  be  a 
protracted  process.  Maritime  authorities  within  each  nation 
must  devote  time  and  resources  to  accomplishing  this  task, 
and,  in  many  instances,  they  may  be  in  competition  with 
other  pressing  issues  before  their  national  governments  and 
legislative  bodies. 

Further,  the  volume  of  new  International  Maritime  Organi¬ 
zation  regulations  has,  in  some  instances,  outpaced  the  abil¬ 
ity  of  some  member  states  to  enact  national  laws  before  the 
IMO  mandatory  instrument  went  into  force.  For  example, 
the  voluntary  audits  revealed  numerous  instances  where 
member  states  implemented  International  Maritime  Orga¬ 
nization  regulations  via  the  rules  of  their  recognized 
organizations  (class  societies,  in  most  cases),  but  still  lacked 
corresponding  national  laws. 

This  could  put  the  recognized  organizations  in  a  difficult 
situation,  inasmuch  as  they  act  as  agents  of  national  gov¬ 
ernments  to  grant  or  deny  international  certificates  the 
International  Maritime  Organization  regulations  require. 
Additionally,  even  though  maritime  administrations  can't 
control  the  priorities  of  their  national  legislative  bodies,  the 
International  Maritime  Organization  views  implementing 
its  instruments  as  a  national  responsibility  —  not  just  the 
function  of  an  isolated  entity  within  a  government. 


Flag  State 

The  very  heart  of  the  IMO  audit  is  the  member  state's 
responsibility  to  ensure  that  the  ships  that  fly  its  flag  are 
safe  and  environmentally  compliant.  All  other  International 
Maritime  Organization  regulations  spring  from  this  basic 
principle.  So  even  when  inspection  functions  are  delegated 
to  third-party  organizations,  the  ultimate  responsibility  to 
verify  compliance  with  the  IMO  instruments  remains  with 
the  member  state. 

That  said,  the  III  Code  allows  delegating  inspection  and  sur¬ 
vey  functions  to  recognized  organizations,  and  most  IMO 
member  states  do  rely  on  recognized  organizations  to  pro¬ 
vide  the  global  reach  necessary  to  carry  out  all  of  the  inspec¬ 
tions  and  surveys  IMO  regulations  require.  To  ensure  that 
these  third  parties  meet  high  standards,  the  International 
Maritime  Organization  recently  created  a  code  for  recog¬ 
nized  organizations,  and  each  member  state  must  verify 
their  recognized  organizations  meet  code  requirements.4 

The  U.S.  delegates  various  inspection  activities  to  a  variety 
of  recognized  organizations,  primarily  International  Asso¬ 
ciation  of  Classification  Societies  member  classification  soci¬ 
eties.  The  Coast  Guard  is  tasked  with  fulfilling  its  duties  for 
oversight  under  the  IMO  instrument,  and  has  fully  adopted 
the  IMO  framework  in  the  recognized  organizations  code  as 
the  model  for  its  oversight  program. 

Port  State 

These  are  the  activities  related  to  control  of  vessels  not 
flagged  under  the  member  state  that  are  in  the  ports  or 
waters  of  the  member  state.  As  noted  in  the  flag  state  dis¬ 
cussion,  the  primary  responsibility  to  verify  that  a  ship  is  in 
compliance  with  the  IMO  regulations  lies  with  the  flag  state. 
However,  port  states  are  allowed  to  verify  that  ships  arriv¬ 
ing  in  their  ports  and  waters  are  in  compliance. 
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The  International  Maritime  Organization  has  established 
guidelines  for  port  state  control;  the  IMO  auditors  will  ver¬ 
ify  that  member  states  are  operating  their  port  state  control 
program  in  accordance  with  those  guidelines.  Also,  this 
area  of  the  audit  includes  the  responsibility  of  the  port  state 
to  prevent  pollution  by  providing  facilities  for  accepting  and 
properly  disposing  of  oil,  sewage,  garbage,  and  other  waste 
from  the  ships  that  call  in  their  ports. 

The  Coast  Guard  conducts  port  state  control  examinations 
for  foreign  vessels  visiting  the  U.S.  using  a  well-defined 
system  that  prioritizes  examinations  based  on  a  variety  of 
factors.  The  Coast  Guard  publishes  an  annual  report  that 
summarizes  the  results  of  these  examinations,  including 
by  flag.5 

Coastal  State 

These  are  the  areas  where  member  states  provide  for  the 
safety  of  ships  and  persons  on  or  adjacent  to  their  coastline. 
This  includes,  among  other  things: 

•  search  and  rescue  capability, 

•  aids  to  navigation, 

•  charting /hydrography  for  the  coastal  waters  of  the 
member  state. 

Depending  on  the  geography  of  the  member  state,  the  need 
for  capability  in  this  area  varies  greatly.  The  U.S.  has  sig¬ 
nificant  resources  and  capability  in  all  these  areas,  due  to 
its  extensive  coastline. 

Looking  Ahead 

There  can  be  an  unfortunate  negative  connotation  associ¬ 
ated  with  any  audit  program,  and  some  may  perceive  that 
the  IMO  member  state  audit  program  is  simply  intended  to 
criticize  member  states  that  lack  the  resources  to  perform 


at  a  level  comparable  to  a  developed  nation  such  as  the  U.S. 
The  proper  view  of  the  audit  system  is  that  the  findings  of 
the  audit  will  assist  the  member  state  by  identifying  areas 
where  improvement  is  needed.  Conversely,  for  those  mem¬ 
ber  states  the  audit  identifies  as  exceptional  performers  in 
certain  areas,  the  audit  system  may  provide  a  source  for 
other  member  states  to  learn  from  best  practices. 

The  International  Maritime  Organization  audits  are  unique 
because  they're  carried  out  by  member  state  government 
personnel  who  are  themselves  active  with  implementing  the 
IMO  instruments  for  their  own  member  state.  In  this  sense, 
the  audit  is  a  form  of  shared  capacity  among  IMO  mem¬ 
ber  states  and  a  peer  review  that  can  provide  perspective 
immensely  helpful  to  the  member  state  being  audited.  When 
viewed  from  this  perspective,  it  is  a  positive  move  toward 
more  consistent  and  effective  international  implementation 
for  the  International  Maritime  Organization  mandatory 
instruments,  which  benefits  all. 

About  the  author: 

Mr.  Hannon  has  served  with  the  Coast  Guard  for  38  years.  He  was  a  marine 
inspector  as  a  Coast  Guard  officer  on  active  and  reserve  duty.  As  a  civilian 
employee  at  Coast  Guard  headquarters,  he  develops  regulations,  policy,  and 
procedures  for  inspection  and  certification  of  U.S. -flagged  commercial  and 
military  sealift  vessels.  He  is  a  U.S.  delegate  to  the  IMO  III  subcommittee,  a 
member  of  the  IMO  audit  scheme  work  group,  and  is  an  IMO  lead  auditor. 

Endnotes: 

L  IMO  Res.  A.1067(28)  on  the  Framework  and  Procedures  for  the  IMO  Member  State 
Audit  Scheme,  December  13,  2013. 

2-  IMO  Res.  A.1068(28)  on  the  Transition  from  the  Voluntary  IMO  Member  State 
Audit  Scheme  to  the  IMO  Member  State  Audit  Scheme,  December  13,  2013. 

3-  IMO  Res.  A. 1070(28)  on  the  IMO  Instruments  Implementation  Code  (III  Code), 
December  13,  2013. 

4-  The  III  Code  specifies  "The  flag  state  shall  establish  or  participate  in  an  oversight 
program  with  adequate  resources  for  monitoring  of,  and  communication  with, 
its  recognized  organization(s)  in  order  to  ensure  that  its  international  obligations 
are  fully  met." 

5-  U.S.  Coast  Guard,  Port  State  Control  in  the  United  States,  2014  Annual  Report. 
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Training 


Nothing  to  Fear 

Objective  auditors  drive  quality 
throughout  organizations. 


by  Captain  Inderjit  Arora 
President  and  CEO 

Quality  Management  International,  Inc. 


The  International  Safety  Management  Code,  International 
Ship  and  Port  Security  Code,  and  other  relevant  standards 
(ISO  9001,  14001,  and  28000)  allow  marine  operators  to 
remain  viable  and  prevent  losses. 

How  do  we  gauge  the  effectiveness  of  such  systems? 
Audits — which  most  mariners  aren't  fond  of,  and  are  gen¬ 
erally  seen  by  those  aboard  as  an  unwanted  intrusion  into  a 
vessel's  working  routine.  This  "interruption"  can  also  make 
masters  nervous  that  auditors  will  find  nonconformities, 
especially  given  the  nature  of  short-term  contractual 
employment  at  sea. 

Internal  process  monitoring  should  result  in  improvement, 
building  a  culture  that  helps  employees  to  determine  and 
meet  the  process  requirements.  Where  organizations  lack 
the  culture  of  the  system  approach,  individuals  are  typically 
blamed  for  any  and  all  failures.  Eventually,  these  individu¬ 
als  fall  back  and  rely  solely  upon  the  occasional  visit  by  their 
auditor.  Is  it  any  surprise,  then,  that  this  visit  is  feared? 

Audits  don't  have  to  be  so  stressful,  given  a  slight  shift  of 
perspective.  Instead  of  asking  "Who?"  every  time  something 
goes  wrong,  asking  "How?"  and  "Why?"  would  strengthen 
the  system  approach  and  remove  the  fear  culture  of  being 
blamed. 

Nonconformities 

Instigating  this  fear  culture  is  "The  Scarlet  N" — noncon¬ 
formities.  Some  organizations  don't  want  to  know  about 
their  nonconformities,  and  that's  a  pity,  because,  in  reality, 
the  only  "bad"  nonconformity  is  the  one  an  organization 
doesn't  know  about. 

In  my  opinion,  some  audit  processes  fail,  in  part,  because 
maritime  audit  experts  have  failed  to  teach  others  to 
appreciate  how  the  bottom  line  is  positively  enhanced  by 


addressing  and  predicting  nonconformities,  recognizing 
risks,  and  changing /updating  processes  before  subsequent 
nonconformities  occur. 

While  nonconformities  invariably  stem  from  an  audit,  they 
should  be  raised  by  anyone  who  notices  one,  proactively 
driving  corrective  action.  For  example,  some  shipping  com¬ 
panies  have  employed  near-miss  reporting/STOP  card 
systems.  The  STOP  (Safety  Training  Observation  Program) 
program  is  a  behavior-based  safety  program  developed  by 
E.I.  DuPont  de  Nemours  &  Co.  designed  to  prevent  injuries 
and  occupational  illnesses  in  the  workplace  through  train¬ 
ing.  For  example,  STOP®  For  Each  Other  is  a  member  of  the 
award-winning  DuPont  family  of  workplace  safety  training 
offerings. 

Management  Buy-In 

Even  if  an  organization  embraces  nonconformities  as  a  call 
to  improved  action,  the  systems  that  result  will  be  poorly 
implemented  if  leaders  lack  commitment  to  them.  It  has 
been  shown,  time  and  time  again,  that  lack  of  buy-in  by 
management  is  the  number  one  variable  responsible  for 
establishing  a  fearful  audit  environment,  ultimately  lead¬ 
ing  to  failure  of  a  quality  system,  irrespective  of  well-trained 
auditors. 

Each  individual  aboard  a  vessel  as  well  as  those  involved 
in  the  vessel  operations  ashore  are  responsible  for  vessel 
quality,  safety,  and  security.  That  said,  ultimate  responsi¬ 
bility  can  never  be  passed  off  down  the  chain  to  the  ves¬ 
sels  and  crews  who  operate  them.  Top  management  must 
take  responsibility  for  system  performance,  with  continual 
improvement  as  the  underlining  goal.  They  can  delegate 
their  authority  only  if  properly  bundled  with  the  right 
resources  to  get  the  job  done. 
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THE  SMOKING  VOLCANO 


A  process-based  system  bridges  the  disconnect  between  the  management  creating 
procedures  and  processes  and  the  crew  carrying  them  out. 


When  top  management  commits  itself,  leading  the  various 
procedures  and  processes,  much  of  the  apprehension  asso¬ 
ciated  with  audits  eventually  evaporates.  Only  then  does 
the  crew  accept  that  an  audit  is  a  vital  part  of  the  success  of 
their  system. 

Qualified  Auditors 

Once  we  envision  an  organization  where  nonconformities 
are  helpful  indicators  and  management  provides  the  sys¬ 
tems,  resources,  and  consistency  to  fuel  continued  improve¬ 
ment,  then  we  have  a  clean  slate  to  show  how  auditors 
contribute  to  this  culture  of  safety  and  success. 

We  begin  with  the  concept  of  a  well-trained,  qualified  audi¬ 
tor —  anything  less  and  management  will  likely  lack  the 
important  buy-in  just  discussed.  Today,  a  larger  percentage 
of  maritime  auditors  are  mariners  themselves,  primarily 
because  they  know  the  environment  so  well.  This  can  be  a 
mixed  blessing,  especially  since,  like  any  profession,  audit¬ 
ing  has  its  own  concepts  and  training  requirements. 

In  general,  auditing  begins  with  ethics  and  performance- 
based  objectives,  not  ulterior  motives.  Well-trained  auditors 
don't  seek  out  ways  to  penalize  crews  for  nonconformities; 
rather,  they  see  their  role  as  looking  for  evidence  of  system 
conformity. 

Auditors  Adding  Value:  A  Well-Defined  Nonconformity 

Where  the  system  doesn't  appear  to  meet  requirements,  the 
auditor  must  serve  the  audit  client  by  providing  detailed, 
objective  evidence  explaining  the  disconnect.  Auditors 
add  value  not  by  giving  advice,  but  by  reporting  noncon¬ 
formities  based  on  actual  requirements  and  supported  by 
the  evidence  observed.  In  the  end,  that  should  be  the  only 
expectation  from  a  good  auditor:  a  well-defined,  objective 
nonconformity. 


Maintaining  this  integrity  in  such  a  black-and- 
white  fashion  should  save  those  under  the 
microscope  feelings  of  defensiveness  —  they 
either  meet  the  requirement  or  they  don't. 
Also,  there  should  be  no  reason  to  fear  this 
valuable  interaction  once  we've  added  to  that 
the  previously  discussed  perspective  of  seeing 
nonconformities  as  helpful  indicators. 

Auditors  add  value  by  examining  evidence  of 
how  well  the  system  helps  its  users  to  recognize 
risks  and  predict  potential  nonconformities  by 
analyzing  data  and  getting  useful  information. 
This  information  should  provide  the  trends  and 
analyses  to  make  decisions  regarding  resources 
and  measures  to  improve  efficiency,  mitigate 
risks,  and  cut  losses  before  they  occur. 

Conflicts  of  Interest 

Flag  state  administrations,  registered  organizations,  and 
registered  security  organizations  should  support  the  audit¬ 
ing  system  by  avoiding  conflicts  of  interest.  For  example, 
when  a  registered  organization  represents  the  flag  state 
for  certifications  and  then  also  chooses  (or  is  nominated  by 
principals)  to  be  the  consultant  and  trainer,  the  objectivity 
of  the  audit  comes  into  question.  Every  stakeholder  in  the 
maritime  industry  must  commit  to  maintaining  the  inde¬ 
pendence  of  the  auditing  institution — a  premise  not  unique 
to  maritime  auditors  alone,  but  one  that  stretches  across  the 
breadth  of  the  supply  chain. 

Self-Audits:  Empowering  the  Workforce 

Auditing  shouldn't  take  the  place  of  self  and  supervisory 
monitoring.  Such  monitoring  involves  the  personnel  who 
perform  and  supervise  the  work — in  particular,  the  des¬ 
ignated  person,  company  security  officer,  superintendent, 
and  so  forth  —  who  provide  the  first  layer  of  objectivity 
regarding  how  well  their  processes  are  fulfilling  objectives. 
A  system  that  uses  only  external  audits  as  a  single  source 
of  system  conformity  inputs  is  inefficient  and  indicative  of 
system  failure. 

As  stated  earlier,  internal  process  monitoring  should  result 
in  rapid  improvements,  building  a  culture  that  helps 
employees  to  determine  and  meet  the  process  requirements. 
Eventually,  the  first  set  of  nonconformities  coming  from  inter¬ 
nal  sources  will  remove  the  fear  of  audits;  nonconformities 
will  be  found,  reported,  and  dealt  with  . . .  and  life  will  go 
on — hopefully,  for  the  better. 
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Audits:  Reasoned  Processes  to  Improve  Quality 

While  5  to  10  percent  of  the  success  of  a  system  can  be 
attributed  to  the  auditor/audit  team,  the  other  90  to 
95  percent  of  the  solution  resides  with  the  leadership 
and  their  team. 

An  audit  of  any  of  the  standards  or  codes  should  ideally 
be  carried  out  by  independent,  mature  auditors  for  the 
sole  purpose  of  determining  whether  or  not  the  sys¬ 
tem  in  place  is  working  as  desired.  With  top-to-bottom 
client  buy-in,  if  nonconformities  are  discovered,  the 
information  should  be  welcomed  and  respected  as 
a  starting  point  to  initiate  the  corrective  action  pro¬ 
cess.  Any  disconnect  between  leadership  policy  and 
the  work-level  manpower  should  be  recognized  as  a 
weakness.  A  good  system  should  bridge  this  gap,  and 
if  it  is,  indeed,  a  gap,  an  audit  would  make  a  finding  to 
that  effect. 

The  entire  evolution,  however,  depends  primarily  on 
the  total  commitment  of  leadership  to  the  process- 
based  management  approach  to  implementation  of 
the  ISM  Code,  the  ISPS  Codes,  and  other  relevant  stan¬ 
dards.  A  viable,  safe,  and  profitable  merchant  marine 
hangs  in  the  balance. 

About  the  author: 

Captain  Inderjit  Arora  is  the  president  and  CEO  of  Quality  Man¬ 
agement  International,  Inc.  (QM1I).  He  serves  as  a  team  leader  for 
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He  is  a  master  mariner  who  holds  a  Ph.D.,  Master  of  Science,  and 
MBA  as  ivell  as  a  32-year  record  of  achievement  in  the  military,  mer¬ 
cantile  marine,  and  civilian  industry. 


Checklist  for  Operators 

J  Auditors  don't  improve  a  system. 

✓  Auditors  have  never  improved  a  system  and  never  will; 
it's  the  top  management/leadership  who  improve  a 
system  by  their  commitment. 

✓  This  article  urges  organizations  to  recognize  that 
the  best  service  their  auditors  can  provide  is  to  be 
objective  and  give  an  organization  correctly  written 
nonconformities  (NCs)  based  on  a  requirement  with 
clear,  correct,  and  factual  evidence,  with  the  nature  of 
the  NC  clearly  stated. 


2  |  Nonconformities  are  integral  to  any  system  improvement. 

They  should  be  welcome.  The  only  "bad"  NC  is  one  not 

known  by  the  organization. 

✓  A  nonconformity  is  the  starting  point  for  a  correction 
and  corrective  action  based  on  root  cause  analysis. 

✓  A  closed  NC  forms  the  data  point  leading  to  a  database 
from  which  information  can  be  drawn  to  analyze  and 
predict  potential  NCs,  appreciate  risk,  and  appreciate 
trends. 


3  |  The  maritime  industry  can  meet  the  objectives  and  func¬ 
tional  requirements  of  the  International  Safety  Manage¬ 
ment  Code  by  ensuring  that: 

✓  Auditing  is  objective. 

✓  One  must  never  consider  the  auditor  a  subject  matter 
expert. 

✓  Auditors  do  not  compromise  their  independence  as 
auditors  by  providing  advice;  doing  so  is  counter¬ 
productive  and  kills  an  organization.  Only  the  top 
management  should  be  responsible  for  corrective 
action. 

✓  An  auditor  performs  yeoman  service  by  giving  a  well- 
worded  objective. 

✓  NCs  encompass  the  requirement,  evidence,  and  nature 
of  the  NC. 


4  |  Auditors  must  be  qualified. 

✓  Being  a  mariner  is  not  sufficient. 

✓  Like  other  disciplines,  auditing  is  a  profession,  which 
requires  training  leading  to  competence.  Competency 
based  on  exposure  must  be  strengthened  by  training 
and  certification  as  an  auditor. 
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Audits  vs.  Inspections 

What's  the  difference? 


by  Mr.  Anthony  D.  Morris 
Mission  Management  System  Administrator 
Force  Readiness  Command 
U.S.  Coast  Guard 


With  America's  port  activities  constantly  changing  and 
growing,  the  Coast  Guard  has  been  forced  to  rapidly  ascer¬ 
tain  the  impact  to  our  workforce  demands  to  effectively 
meet  our  maritime  customers'  and  partners'  needs. 

For  example,  it's  imperative  that  the  Coast  Guard  continues 
to  facilitate  commerce  in  a  secure  and  safe  environment.  To 
help  meet  this  demand  within  the  scope  of  our  stated  mis¬ 
sion  requirements.  Coast  Guard  leadership  must  innovate 
and  adapt  different  methods  to  carry  out  mission  require¬ 
ments.  One  such  area  of  focus  involves  reviewing  our  over¬ 
all  maritime  compliance  regimen  to  look  for  opportunities 
to  audit  overall  systems  as  a  means  to  achieve  and  maintain 
compliance  from  our  maritime  customers  and  partners. 

So  what  is  the  difference  between  auditing  and  inspecting? 
Can  auditing  be  used  as  our  primary  source  to  determine 
compliance?  Are  inspections  still  a  useful  tool  as  part  of  our 
overall  security  and  safety  compliance  strategy? 

Audits  Versus  Inspections 

Auditing  is  a  process  that  independently  evaluates  and  mea¬ 
sures  procedures,  processes,  and  standards.  The  process 
may  include  reviewing  work  instructions,  guidelines,  laws. 


regulations,  or  other  government  or  commercial  require¬ 
ments,  including  contracts. 

The  audit  determines  conformity,  shows  if  procedures 
were  performed  as  intended,  and  determines  whether  each 
requirement  was  followed  or  executed  as  planned.  In  short, 
audits  are  generally  designed  to  verify  conformity  to  stated 
requirements. 

Unlike  audits,  inspection  activities  and  processes  tend  to 
be  more  specific.  For  example,  an  inspector  might  do  an 
in-depth  examination  of  an  action  or  piece  of  equipment  to 
make  sure  it's  doing  the  exact  thing  it's  supposed  to  do  as  it 
relates  to  the  function  of  the  overall  system.  In  most  inspec¬ 
tions,  there  is  usually  a  dedicated  checklist  with  specific 
items  that  need  to  be  visually  checked  or  seen  operating  to 
ensure  they  exist  or  properly  function. 

Inspections  determine  compliance  with  a  specific  regula¬ 
tion  or  standard,  are  generally  designed  to  find  deficiencies 
or  nonconformities,  and  are  conducted  with  much  greater 
frequency  than  audits.  In  sum,  the  result  of  an  inspection 
might  be  that  a  specific  piece  of  equipment  is  found  to  be 
not  functional,  whereas  the  findings  of  an  audit  might 


Inspections,  such  as  this  one  of  an  engine  control  room,  are  imperative  to  discovering  deficiencies.  U.S.  Coast  Guard  photo  by  ENS  Jordan  Ortiz. 
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be  that  the  system  designed  to  maintain  the  equipment 
is  not  functional. 

More  on  Audits 

Audits  are  not  "pass /fail."  They  help  to  identify 
nonconformities  (weaknesses  or  areas  of  concern 
within  a  working  system)  so  that  workers  know  to  take 
some  sort  of  corrective  action.  Audits  are  designed  to 
be  nonpunitive,  identify  where  improvement  is  neces¬ 
sary,  and  employ  a  predetermined  process  to  execute 
appropriate  corrective  action.  In  addition,  once  the  cor¬ 
rective  action  is  taken,  further  steps  are  noted  to  prevent 
nonconformities  from  recurring. 

Audits  should  not  be  feared — by  design,  auditors  use 
an  agreed-upon  standard  to  measure  effectiveness  and 
overall  system  compliance.  While  audits  are  conducted 
on  a  periodic  basis  and  are  usually  less  frequent  than 
inspections,  they  are  generally  better  at  identifying 


systematic  conformance  and  nonconformance  that  can  be 
traced  back  to  an  overarching  requirement. 

This  is  important  for  audits  and  auditors,  because  it  clearly 
shows  the  requirement  for  a  process  to  function  as  designed. 
Audits  don't  rely  on  guesswork  or  possibilities;  audits  use 
existing  requirements  to  determine  conformity. 

More  on  Inspections 

Inspections  have  been  a  longstanding  tool  within  the  Coast 
Guard,  handed  down  through  generations  of  personnel 
within  prevention  and  other  program  elements.  Inspec¬ 
tions  ensure  that  deficiencies  are  discovered  and  proper 


Audits  identify  systemic  issues; 
inspections  determine  if  system 
parts  function  as  intended. 

Audit  result:  The  system  designed 
to  maintain  the  equipment  is  func¬ 
tional/not  functional. 

Inspection  result:  Equipment  is 
functional/not  functional. 


Subject  matter  experts  review  documents  associated  with  Standards  of  Training, 
Certification,  and  Watchkeeping  requirements  taught  at  a  maritime  academy. 
U.S.  Coast  Guard  photo  by  Anthony  Morris. 
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What  This  Means 
for  the  Coast  Guard 


Both  audits  and  inspections  are  important  Coast  Guard 
tools,  and  continued  growth  in  America's  port  activities, 
changes  in  commerce  and  the  maritime  industry,  and 
response  to  disasters  means  that  the  Coast  Guard  must 
use  every  tool  possible  to  keep  pace  and  effectively 
facilitate  commerce. 

As  new  legislation  is  promulgated,  Coast  Guard  leaders 
often  issue  new  or  modified  regulations  and  policies, 
which  field  personnel  must  implement  and  enforce.  It  is 
therefore  critical  to  understand  systems  and  processes 
to  ensure  regulation  and  policy  effectiveness. 

The  Mission  Management  System 

Since  adopting  the  mission  management  system 
(MMS)  —  a  set  of  policies,  processes,  and  procedures 
to  plan  and  execute  established  requirements  —  to 
support  this  effort,  auditing  has  become  a  valuable 
tool  to  provide  managers  with  the  feedback  necessary 
to  make  more  informed  decisions  and  achieve  greater 
conformity  to  system  requirements. 

The  MMS  and  auditing  performance  results  provide 
Coast  Guard  leaders  with  a  better  idea  of  the  effective¬ 
ness  of  their  efforts  to  execute  our  mission  and  keep 
pace  with  a  growing  maritime  industry. 

IMO  Audits 

As  a  member  of  the  International  Maritime  Organiza¬ 
tion  (IMO)  and  a  volunteer  for  the  now-mandatory  IMO 
member  state  audit  scheme,  the  Coast  Guard  is  required 
to  audit  its  port  state,  flag  state,  and  coastal  state  instru¬ 
ments  to  analyze  how  to  implement,  enforce,  and 
harmonize  international  and  domestic  requirements. 

By  using  audits  to  periodically  check  on  the  progress  of 
efforts  to  conform  to  these  system  requirements,  and 
by  using  inspections  as  a  tool  to  frequently  verify  and 
correct  the  details  within  the  system,  the  Coast  Guard 
will  be  able  to  demonstrate  overall  conformity  to  the 
audit  scheme's  requirements. 


fixes  implemented,  which  can  save  lives,  save  prop¬ 
erty,  and  reduce  costs. 

Inspections  may  also  generate  results  that  can  be 
analyzed  as  lagging  trend  indicators.  By  reviewing 
historical  inspection  records,  inspectors  can  iden¬ 
tify  certain  problem  areas,  which  can  help  them  to 
develop  regulations  or  policy  to  enhance  safety  or 
security.  This  data  can  also  help  leaders  determine 
how  resources  should  be  used  to  maximize  compli¬ 
ance  with  regulations  or  policies. 

Audit  and  Inspection  Synergy  Benefits 

Audits  identify  systemic  issues  that  can  reveal  trends 
of  conformity  and  nonconformity  within  the  system, 
and  inspections  can  ensure  that  the  individual  parts 
of  the  system  are  functioning  as  intended.  Therefore, 
the  synergy  between  audit  and  inspection  can  be  used 
to  more  effectively  employ  our  limited  resources. 

For  example,  audits  can  measure  system  performance 
to  allow  for  better  trend  analysis,  which  can  identify 
areas  that  need  a  more  detailed  review  or  functional¬ 
ity  inspection  to  determine  if  preventive  measures 
should  be  taken. 


Audits  are  not  pass/fail. 


About  the  author: 
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Investigations  and  Safety  Management  Systems 


A  Tale  of  Two  Ships 

Examining  SMS  similarities, 
strengths,  and  weaknesses. 


by  Mr.  Keith  Fawcett 
Investigations  National  Center  of  Expertise 
U.S.  Coast  Guard 


Each  year.  Coast  Guard  marine  investigators  conduct  inves¬ 
tigations  into  marine  casualties.  Part  of  that  process  involves 
examining  the  vessel's  safety  management  system  (SMS). 
Two  unique  incidents  in  2012  and  their  follow-on  investiga¬ 
tions  give  us  unique  insight  into  this  process. 

The  year  started  with  an  allision,  as  a  motor  vessel  ran  into 
a  highway  bridge  on  a  lake  in  Kentucky,  causing  a  300-foot 
bridge  span  to  drop  onto  the  vessel  and  into  the  Tennessee 
River.  As  2012  ended,  another  vessel  in  the  Gulf  of  Alaska 
struggled  to  control  a  mobile  offshore  drilling  unit  (MODU), 
which  eventually  grounded.  Both  vessels  were  conducting 
unique  operations  in  unique  environments. 

Delta  Mariner — The  Incident 

In  late  January  2012,  the  motor  vessel  Delta  Mariner  was  car¬ 
rying  rocket  motors  in  her  cargo  bay  as  she  transited  the 
Tennessee  River  en  route  to  Cape  Canaveral,  Florida.1  As  she 
neared  the  Eggner's  Ferry  Bridge  that  spanned  the  Tennes¬ 
see  River  in  the  vicinity  of  Aurora,  Kentucky,  it  was  raining, 
but  the  rain  was  easing  up. 


Up  ahead  loomed  the  highway  bridge,  where  a  buoyed 
channel  and  sailing  line  on  the  U.S.  Army  Corps  of  Engi¬ 
neers  river  chart  indicated  the  main  channel.  The  vessel 
crew  included  a  team  of  capable  merchant  marine  officers. 
In  addition,  the  vessel  operators  put  a  marine  contract  pilot 
aboard  to  assist  the  ship's  officers  on  this  segment  of  the 
waterway.2  This  was  not  a  regulatory  requirement,  but  a 
proactive  safety  practice  for  the  operating  company.  The 
ship  also  had  a  safety  management  system  in  place. 

As  the  ship  neared  the  highway  bridge,  personnel  noted 
that  the  lighting  on  the  bridge  wasn't  quite  right;  there  were 
discrepancies  in  the  correct  lighting  scheme  for  the  bridge. 
Most  importantly,  the  center  of  the  main  navigational  span, 
where  larger  vessels  travel,  was  supposed  to  have  three 
powerful  white  vertical  lights  to  distinguish  that  span  and 
the  centerline  of  the  channel  for  vessels  required  to  transit 
that  section  of  the  bridge.3 

As  the  minutes  ticked  by,  the  pilot  decided  to  alter  the 
ship's  course  to  steer  for  another  span  that  was  adjacent 
to  the  lighted  recreational  vessel  span,  closer  to  the 
right  side  of  the  shoreline.  Time  was  short  as  the  ship 
moved  off  the  sailing  line  indicated  on  the  electronic 
chart  and  headed  for  that  opening.  Moments  later,  the 


The  M/V  Delta  Mariner  anchored  to  the  river  bottom  in  Kentucky  Lake  on  the  Ten¬ 
nessee  River  with  the  span  of  the  Eggner’s  Ferry  Bridge  draped  across  her  bow. 
Photo  courtesy  of  the  National  Transportation  Safety  Board. 


Spreadsheet  developed  aboard  the  M/V  Delta  Mariner  showing 
the  bridges  and  overhead  obstructions  on  the  inland  waterway 
where  overhead  restrictions  would  be  a  problem.  The  ship’s  offi¬ 
cers  used  colors  to  highlight  the  potential  for  danger.  U.S.  Coast 
Guard  photo. 
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This  photo  looking  forward  toward  the  after  superstructure  of  the  M/V  Aiviq  shows  some  of  the 
complex  systems  aboard  the  vessel,  such  as  towing,  firefighting,  and  lifting  equipment.  U.S.  Coast 
Guard  photo. 


vessel  struck  the  low-hanging  bridge  span,  and  the  bridge 
span  fell  onto  the  bow  of  the  ship  and  into  the  waters  of  the 
Tennessee  River. 


As  the  investigations  unfolded,  the  inves¬ 
tigators  looked  at  the  accident  scenes,  ves¬ 
sels,  shoreside  management  personnel, 
and  all  the  related  facets.  Then,  as  a  mat¬ 
ter  of  routine,  the  investigators  reviewed 
the  procedures,  policies,  job  aids,  plans, 
checklists,  and  vessel  safety  management 
systems.  Investigators  went  on  to  look  at 
each  vessel's  specific  operational  history  to 
determine  if  vessel  operators  had  identified  lessons  learned 
from  past  operations  as  well  as  the  specific  risks  the  vessels 
could  have  encountered  over  a  significant  operating  period. 


vessel  design  for  transiting  bridges  and 
other  overhead  obstructions  on  her  transit 
segments  through  America's  inland  water¬ 
ways.  Her  propulsion  system  incorporated 
a  rotating  twin  screw  propulsion  system, 
with  additional  thrusters  and  controlla¬ 
ble-pitch  propellers.  The  Aiviq  featured 
an  icebreaking  hull  along  with  multiple 
thrusters,  controllable-pitch  propellers,  and 
a  state-of-the-art  towing  winch  with  a  ten¬ 
sion  monitoring  system  to  check  the  strain 
on  towing  equipment. 


MODU  Kulluk — The  Incident 

In  December  2012,  the  motor  vessel  Aiviq  was  towing  the 
MODU  Kulluk  across  the  Gulf  of  Alaska.  As  the  voyage  pro¬ 
gressed,  the  ship  encountered  a  series  of  severe  weather 
systems  that  tested  her  towing  plans.  On  December  27,  the 
towing  gear  failed,  setting  the  MODU  Kulluk  adrift  with  her 
18-man  crew.4 

The  Aiviq  ultimately  lost  all  main  propulsion  engines  that 
day.  Luckily,  the  vessel  had  a  series  of  electric  thrusters, 
including  one  rotating  thruster,  which  allowed  her  some 
limited  maneuverability  and  towing  power.  Over  the  next 
four  days,  the  Aiviq  response  vessel  crews,  helicopter  crew, 
shoreside  support  personnel,  and  unified  command  mem¬ 
bers  mitigated  the  worst  of  the  effects  of  the  incident,  but  on 
December  31,  the  Kulluk  grounded  on  the  shore  of  Alaska. 

Searching  for  Links 

Here  we  have  two  unique,  purpose-built  ships;  two  differ¬ 
ent  accidents;  and  great  peril  for  the  people,  environment, 
and  property  involved.  Where  are  the  safety  management 
system  links? 

In  both  cases,  the  ships  were  carefully  and  thoughtfully 
designed  for  their  unique  missions.  The  Delta  Mariner  had 
masts  that  could  be  lowered,  and  featured  a  low-profile 


In  the  case  of  the  bridge  allision,  the  vessel  involved  had 
transited  that  particular  bridge  on  numerous  occasions, 
while  in  the  case  of  the  towing  operation,  this  was  the  ves¬ 
sel's  first  winter  transit  through  the  Gulf  of  Alaska — a  voy¬ 
age  of  more  than  1,700  nautical  miles. 

Delta  Mariner — The  Investigation 

In  the  case  of  the  Delta  Mariner,  the  ship  had  a  safety  man¬ 
agement  system  in  place  to  address  the  challenges  it  was 
expected  to  encounter  along  the  route,  including  the  numer¬ 
ous  bridges  and  high-tension  power  lines  the  ship  would 
transit  beneath. 

The  ship  also  employed  a  marine  contract  pilot  to  provide 
the  ship's  officers  with  advice  along  the  route.  In  the  case 
of  the  marine  contract  pilot,  the  SMS  needed  to  address 
the  role  of  the  pilot  as  well  as  the  master/pilot  informa¬ 
tion  exchange,  so  that  prior  to  handling  the  vessel,  the  pilot 
would  understand  the  unique  characteristics  of  the  vessel 
as  well  as  any  problems  they  might  have  to  deal  with  using 
critical  ship  equipment. 

The  vessel's  SMS  did  discuss  the  pilot/ master  exchange  and 
the  pilot's  role  and  duties,  but  investigators  had  to  deter¬ 
mine  if  that  SMS  procedure  was  followed  as  specified. 
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According  to  the  National  Transportation  Safety  Board 
(NTSB)  report: 

The  investigation  revealed  that  the  Delta  Mariner's 
safety  management  system,  developed  by  the  company 
more  than  10  years  earlier  and  in  place  at  the  time  of 
the  accident,  ivas  not  effectively  implemented.  Overall, 

[the  company]  provided  ineffective  oversight  of  the  Delta 
Mariner's  operations. 

Due  to  the  vessel's  good  safety  record  and  the  company's 
reliance  on  proactive  safety  measures  and  a  crew  of  well- 
trained,  experienced  deep-sea  mariners  to  provide  a  high 
level  of  safety,  the  company  became  complacent  regarding 
the  safety  of  the  vessel's  operations. 

The  investigation  also  found  the  expertise  required  of  con¬ 
tract  pilots  was  not  clearly  defined,  and  contract  pilots 
and  the  Delta  Mariner's  deck  officers  lacked  clear  under¬ 
standing  of  the  guidance  expected  from  contract  pilots 
while  serving  on  the  bridge  of  a  vessel. 

In  addition,  the  safety  management  system  discussed  a 
passage  plan,  which  is  used  to  plan  a  voyage  and  take  into 
account  all  difficulties  the  vessel  expects  to  face  along  the 
transit.  The  passage  plan  was  also  supposed  to  detail 
the  strategies  proposed  to  mitigate  any  risks  encountered. 

The  NTSB  report  noted: 

[The  company's]  safety  management  system  documents 
stated,  A  passage  plan  is  of  no  value  unless  it  is  utilized 
by  all  team  members  —  including  the  pilot.'  Investigators 
found  no  evidence,  however,  that  the  passage  plan  was 
reviewed  by  deck  watch  officers  during  the  voyage. 

The  National  Transportation  Safety  Board  report  also  noted: 

As  the  vessel  approached  Eggner's  Ferry  Bridge,  the 
bridge  team  and  contract  pilot  of  the  Delta  Mariner 
were  largely  unaware  of  what  lighting  should  have  been 
visible  on  the  bridge  and  which  span  allowed  sufficient 
clearance  for  safe  passage. 

The  contract  pilot  and  bridge  team  focused  exclusively  on 
the  few  lights  visible  on  the  bridge  while  ignoring  readily 
available  electronic  charting  system  displays,  which  could 
have  provided  critical  information  about  the  vessel's  posi¬ 
tion  in  relation  to  the  bridge  and  the  bridge's  correct  light¬ 
ing  scheme.  Despite  this  lack  of  information,  the  contract 
pilot  continued  to  direct  the  vessel  toward  a  span  that 
was  too  low  for  the  Delta  Mariner.  Further,  despite  the 
contract  pilot's  apparent  uncertainty,  none  of  the  bridge 
team  challenged  his  directions. 


The  SMS  in  place  on  board  the  Delta  Mariner  addressed 
the  company's  expectation  for  bridge  team  manage¬ 
ment,  including  maintaining  a  focused  watch,  the  open 
exchange  of  information,  the  prevention  of  distraction, 
and  the  creation  of  a  team  environment.  The  practice  of 
good  seamanship  was  to  be  observed  at  all  times  on  watch, 
and  each  individual  on  watch  was  required  to  be  alert  and 
attentive  to  their  respective  duties  relevant  to  the  safety 
of  the  vessel. 

The  master  and  DWOs5  were  instructed  to  always 
' remain  alert  to  the  pilot's  or  mooring  master's  handling 
of  the  vessel  and  be  prepared  to  intervene  when  necessary 
to  safeguard  personnel,  environment,  vessel,  or  cargo.’ 

The  NTSB  report  further  refers  to  a  sequence  of  events  that 

began  as  the  ship  approached  the  Eggner's  Ferry  Bridge: 

. . .  when  the  C/M6  received  his  first  instruction  from 
the  pilot  to  steer  towards  the  green  light  of  the  'E'  span, 
through  the  time  of  the  vessel's  allision  with  the  EFB,7 
none  of  the  crewmembers  present  upon  the  vessel’s  navi¬ 
gation  bridge  countermanded  or  challenged  the  pilot’s 
instruction  to  steer  toward  the  green  light  marking  the 
center  of  the  'E'  span. 

As  the  vessel  continued  on  its  course,  no  attempt  was 
made  by  the  pilot,  or  the  crewmembers  to  obtain  a  fix  upon 
the  vessel’s  position  using  other  than  visual  means  with 
the  vessel’s  two  spotlights.  Per  the  SMS,  the  responsibility 
for  obtaining  vessel  position  fixes  was  the  responsibility  of 
the  DWO  who  was  not  on  the  helm  position,  in  this  case, 
the  3/M.8  The  SMS  stated,  'the  helmsman  shall  have  no 
other  duties  when  assigned  to  the  helm,'  and  'when  the 
deck  watch  officer  is  acting  as  helmsman,  a  second  deck 
officer  and,  or  the  master  will  be  on  the  bridge  to  perform 
all  other  navigation  and  watch  duties.' 

Ultimately,  the  ship  struck  the  lighted  recreational  span  of 

the  Eggner's  Ferry  Bridge  on  the  east  side  of  Kentucky  Lake. 


Screen  capture  from  a  cell  phone  video  taken  by  a  mate  aboard  the  M/V 
Aiviq  shows  the  tow  wire  on  the  right  leading  to  the  MODU  Kulluk  under 
tow.  The  computer  screen  on  the  left  shows  the  readout  in  tons  on  the 
towing  hawser  (boxed  in  yellow)  as  227  metric  tons.  The  vessel’s  crew 
failed  to  recognize  the  importance  of  this  critical  measurement.  U.S. 
Coast  Guard  image. 
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MODU  Kulluk — The  Investigation 

On  December  27,  2012,  out  in  the  Gulf  of  Alaska,  the  Aiviq 
was  towing  the  Kulluk  astern.9  Looking  out  the  after  wheel- 
house  windows,  one  of  the  mates  on  duty  took  a  cell  phone 
video  of  the  seas  and  the  Kulluk  astern  on  the  tow  hawser. 
The  video  captured  the  hawser  rising  up  from  a  somewhat 
slackened  condition  until  it  was  almost  horizontal  to  the 
deck  of  the  Aiviq.  It  then  led  from  the  winch  through  the 
sea  and  swell,  leading  out  to  the  Kulluk  almost  a  quarter  of 
a  mile  astern. 

The  downward  deflection  of  the  towing  hawser  is  called 
catenary,  which  is  one  of  the  ways  marine  personnel  assess 
towing  operation  safety.  Correct  use  of  this  catenary  absorbs 
the  everyday  stresses  and  strains  of  ocean  towing,  reducing 
the  cyclic  loading  on  critical  equipment. 

During  the  voyage,  the  Aiviq 's  sophisticated  towing  winch 
strain  gauge  located  in  the  wheelhouse  showed  the  load 
on  the  towing  equipment.  In  the  cell  phone  video  segment, 
the  strain  monitor  showed  the  towing  load  swinging  from 
28  tons  to  228  tons.  The  mate  commented  on  the  strength  of 
the  steel  towing  wire.  From  departure  to  the  point  where  the 
towing  equipment  failed,  there  was  near-continuous  cyclic 
loading  on  the  towing  equipment. 

In  the  late  morning  of  December  27, 2012,  the  first  in  a  series 
of  towing  gear  failures  occurred.  There  would  be  more 
gear  failures  as  efforts  took  place  to  control  the  Kulluk  in 
the  extreme  maritime  weather  environment  of  the  Gulf  of 
Alaska.  At  one  point,  the  Aiviq  suffered  the  loss  of  main 
engines,  generator  injector  failures,  and  other  issues  with 
maneuvering  thrusters  while  attempting  to  tow  the  Kulluk. 

The  Coast  Guard  investigation  focused  on,  among  other 
things,  the  SMS  in  place  for  the  Aiviq  and  her  crew  as  well 


as  the  crew's  training,  competencies,  and  qualifications. 
The  investigators  looked  for  formal  or  informal  policies, 
procedures,  job  aids,  checklists,  and  other  documentation 
indicative  of  how  the  unique  towing  operation  was  to  be 
carried  out. 

Unfortunately,  investigators  were  unable  to  uncover  what 
constituted  a  safety  management  system  related  to  towing 
operations.  During  the  course  of  the  investigation,  it  was 
determined  that  there  was  a  disconnect  as  to  the  role  and 
responsibilities  for  the  towing  vessel  master  and  the  tow 
master  on  the  towed  vessel  Kulluk.  A  safety  management 
system  would  have  detailed  the  roles  and  responsibilities 
for  these  personnel,  reducing  ambiguity  in  the  most  critical 
moments. 

Additionally,  details  on  the  use  of  the  ultra-sophisticated 
towing  winch,  used  to  monitor  and  trend  chart  the  load 
on  the  towing  system  and  monitor  the  length  of  the  tow¬ 
ing  hawser,  were  not  discussed  in  the  vessel's  operating 
procedures.  The  tow  system  was  equipped  with  alarms  for 
critical  events  on  the  vessel,  but  bridge  officers  could  not 
elaborate  as  to  how  the  alarms  and  response  to  those  alarms 
constituted  a  part  of  a  comprehensive  plan  for  towing  the 
manned  tow. 

On  the  morning  of  the  initial  towing  gear  failure,  there  were 
38  critical  alarms  for  the  towing  winch  system  that  indi¬ 
cated  strains  of  at  least  300  metric  tons.  The  part  that  ini¬ 
tially  failed  (or  was  lost)  was  a  shackle  with  a  safe  working 
load  of  125  tons.  A  robust  SMS  would  have  indicated  how  to 
handle  these  alarms  or  would  have  pointed  the  reader  to  the 
proper  place  where  these  strategies  could  have  been  found. 
Without  going  into  all  the  deficiency  elements  of  the  towing 
operations,  it  would  be  appropriate  to  state  that  a  robust 
and  well-written  SMS  that  incorporated  lessons  learned  and 


In  the  photo  above,  the  bridge  control  equipment  on  the  M/V  Delta  Mariner, 
and  similar  propulsion  control  equipment  aboard  the  M/V  Aiviq  (right).  Such 
complex,  sophisticated  equipment  requires  putting  a  comprehensive  safety 
management  system  in  place  so  the  vessel’s  crew  knows  how  to  operate  the 
systems  under  all  kinds  of  expected  conditions.  U.S.  Coast  Guard  photos. 
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appropriate  risk  assessment  from  previous  towing  voyages 
could  have  helped  to  mitigate  the  events  that  transpired  on 
that  voyage. 

The  Aiviq  did  have  a  safety  management  system  in  place,  but 
the  investigators  could  not  find  details  for  towing  operations 
or  anything  directly  related  to  towing  operations.  Specific 
written  documentation  addressing  the  safety  for  towing 
operations,  such  as  voyage  planning,  towing  speeds  or  rout¬ 
ing,  towing  gear  maintenance,  roles  and  responsibilities,  or 
inspections  of  equipment  outside  the  ship-specific  equip¬ 
ment  were  not  addressed.  This  shortfall  existed  despite  the 
fact  that  by  custom  and  court  interpretation,  the  towing 
vessel  assumes  complete  responsibility  for  the  safety  of  the 
tow  once  the  towing  hawser  is  connected. 

Learning  from  the  SMS  Links 

A  robust  and  well-thought-out  safety  management  system 
would  have  significantly  reduced  the  risks  in  both  of  these 
incidents.  In  the  case  of  the  Eggner's  Ferry  Bridge  allision, 
the  NTSB  report  cites: 

The  passage  plan  provided  inadequate  information 
for  safe  navigation  on  the  inland  waters  portion  of  the 
intended  journey. 

The  bridge  team  overly  relied  on  the  direction  of  the 
contract  pilot,  despite  his  apparent  uncertainty,  which 
resulted  in  the  bridge  team  attempting  to  maneuver  the 
vessel  under  the  incorrect  span. 

The  contract  pilot  and  the  bridge  team  failed  to  effectively 
utilize  all  navigation  tools,  such  as  the  electronic  chart¬ 
ing  system  and  radar,  as  they  approached  Eggner's  Ferry 
Bridge. 

The  [vessel's]  safety  management  system  was  not  effec¬ 
tively  implemented  on  board  the  vessel  at  the  time  of  the 
accident. 

Focusing  on  just  the  towing  operations  for  the  Aiviq,  a 
detailed  safety  management  system  covering  towing  opera¬ 
tions,  voyage  route  planning,  vessel  standing  orders,  use 
of  towing  strain  monitoring  equipment,  and  the  role  and 
responsibilities  of  bridge  watch  officers  engaged  in  towing 
would  have  greatly  reduced  the  chances  of  critical  towing 
gear  failure. 

A  vessel's  safety  management  system  is  a  critical  safety  com¬ 
ponent  of  vessel  operations.  As  such,  it  needs  to  be  well 


developed,  well  understood,  and,  most  importantly,  well 
followed.  To  ensure  the  safety  of  people,  the  environment, 
and  property,  periodic  reviews  are  necessary,  as  are  atten¬ 
tion  to  the  lessons  learned  from  previous  operations  and  the 
changing  risks  associated  with  vessel  operations. 

Since  the  time  of  the  NTSB  investigation,  it  has  been  reported 
that  the  operating  companies  for  the  two  vessels  involved 
have  critically  assessed  the  accidents  and  have  made  a  series 
of  significant  improvements  related  to  their  safety  manage¬ 
ment  systems  and  vessel  operation  policies. 

About  the  author: 

Mr.  Keith  Fawcett  is  a  licensed  mariner  and  a  staff  member  at  the  USCG 
Investigations  National  Center  of  Expertise.  He  has  ivorked  in  the  marine 
industry  for  more  than  20  years,  has  conducted  several  high-profile  marine 
casualty  investigations  for  the  Coast  Guard,  and  is  one  of  the  winners  of  the 
Sener  Aumrd  for  excellence  in  marine  casualty  investigations. 

Endnotes: 

L  As  the  Delta  Mariner  Coast  Guard  investigation  is  ongoing,  this  article  references 
the  National  Transportation  Safety  Board  (NTSB)  final  report  "Allision  of  the 
Cargo  Vessel  M/V  Delta  Mariner  with  Eggner's  Ferry  Bridge,  Tennessee  River 
Near  Aurora,  Kentucky  January  26,  2012  Accident  Report  NTSB/MAR-13/02"  as 
the  basis  for  its  analyses  and  conclusions.  Please  note  that  any  section  in  italics 
indicates  information  directly  quoted  from  this  report,  which  can  be  found  at 
http:  /  /  dms.ntsb.gov/ pubdms/ search/document.cfm?docID=395429&docketID= 
52354&mkey=82752 . 

2-  According  to  the  same  NTSB  report  mentioned  above,  the  owner  of  the  Delta 
Mariner  regularly  hired  experienced  towing  vessel  masters  to  guide  and  assist  the 
bridge  team  for  the  portion  of  its  inland  rivers  route  between  Decatur,  Alabama; 
and  Baton  Rouge,  Louisiana.  For  the  purposes  of  this  report,  these  individuals  are 
referred  to  as  contract  pilots.  They  were  not  federally  or  state-licensed  pilots,  but 
they  held  Coast  Guard-issued  master  of  towing  vessel  licenses. 

3-  From  the  NTSB  report,  "Navigation  lighting  on  Kentucky  bridges"  section, 
page  viii.  Given  that  Eggner's  Ferry  Bridge  was  not  properly  lit  on  the  night  of  the 
accident,  the  NTSB  investigated  the  maintenance  of  lighting  on  Kentucky  bridges 
crossing  navigable  waterways.  The  investigation  found  that  the  Kentucky  Trans¬ 
portation  Cabinet  (KYTC),  the  owner  of  the  bridge,  failed  to  effectively  maintain 
the  bridge's  lighting  in  accordance  with  the  Coast  Guard-approved  lighting  plan. 
The  KYTC  also  did  not  identify  and  resolve  recurring  lighting  problems  and  their 
causes.  The  NTSB  found  that  the  personnel  in  the  division  performing  repairs 
relied  on  inadequate  knowledge  of  the  correct  lighting  configuration,  and  that  the 
KYTC's  oversight  of  its  bridge  navigation  lighting  maintenance  was  ineffective. 

4-  MODU  Kulluk  investigation. 

5-  Deck  watch  officers. 

6-  Chief  mate. 

7  Eggner's  Ferry  Bridge. 

8-  Third  mate.  There  were  two  licensed  officers  on  the  bridge.  Due  to  the  unique 
design  of  the  vessel  and  the  propulsion  system,  only  licensed  officers  actually 
steered  the  vessel  through  this  segment  of  the  waterway. 

9-  Facts  and  chronology  from  the  U.S.  Coast  Guard  report  "Report  of  the  Investiga¬ 
tion  Into  the  Circumstances  Surrounding  the  Multiple  Related  Marine  Casualties 
and  Grounding  of  the  MODU  Kulluk  on  December  31st,  2012,"  found  at  www.uscg. 
mil/hq/cg5/cg545/docs/documents/Kulluk.pdf. 
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Suspension  and  Revocation 
for  Safety  Management  System 

Violations 

Maintaining  standards  for  competence  and  conduct 

essential  to  safety  at  sea. 


by  CDR  Christopher  F.  Coutu 
Chief 

Suspension  and  Revocation  National  Center  of  Expertise 
U.S.  Coast  Guard 


The  benefits  of  shipboard  safety  management  systems 
(SMSs)  are  myriad  —  a  crew's  conduct  and  adherence  to 
vessel  operation  procedures  at  sea  can  mean  the  differ¬ 
ence  between  a  safe,  profitable  voyage  and  one  resulting  in 
disaster.  While  safety  management  systems  are  generally 
required  for  large  oceangoing  vessels  involved  in  foreign 
trade,  smaller  vessels  and  domestic  companies  have  imple¬ 
mented  them  to  identify — in  one  location — the  important 
company  policies,  practices,  and  procedures  a  ship's  crew 
is  expected  to  follow  to  ensure  a  safely  functioning  vessel. 

Safety  management  systems  help  ensure  that  ship  person¬ 
nel  comply  with  mandatory  safety  rules  and  regulations 


and  also  follow  codes,  guidelines,  and  classification  society 
requirements  as  well  as  concerned  maritime  organization 
parameters.  In  short,  the  SMS  establishes  a  standard  of  con¬ 
duct,  encapsulates  shipboard  policies,  and  defines  the  rules 
governing  safe  ship  operation. 

In  the  Coast  Guard  world  of  mariner  license  suspension 
and  revocation  (S&R),  the  SMS  can  provide  a  standard  upon 
which  the  conduct  of  a  mariner  is  judged — the  backbone 
upon  which  the  body  of  an  investigation  may  be  formed  and 
ultimately  enforced. 

License  Enforcement  Backdrop 

Before  we  delve  into  how  safety  management  systems  fit 
within  the  construct  of  a  potential  S&R  action,  a  bit  of 
background.  The  privilege  of  sailing  on  American  ves¬ 
sels  is  contingent  upon  possessing  a  merchant  mariner 
credential  (MMC  or  "credential").  Congress  charged 
the  Coast  Guard  with  vetting  prospective  mariners 
and  issuing  MMCs  to  qualified  individuals.1  These 
documents  serve  as  occupational  licenses  —  a  mari¬ 
ner's  "ticket"  to  a  career  at  sea.  Along  with  requiring 
mariners  to  hold  a  credential  to  serve  aboard  vessels 
in  specific  capacities.  Congress  also  charged  the  Coast 
Guard  with  disciplining  the  same  mariners  by  way  of 
suspending  or  even  revoking  credentials  through  sus¬ 
pension  and  revocation  actions  on  the  credential  itself. 


LTJG  Stephanie  Kurucar  of  Coast  Guard  Sector  New  Orleans  reviews  crew  creden¬ 
tials  and  licenses.  U.S.  Coast  Guard  photo  by  Petty  Officer  Casey  J.  Ranel. 


The  necessity  for  federal  oversight  was  born  out  of  a 
string  of  maritime  tragedies.  For  example,  in  1832, 
about  14  percent  of  steam  vessels  in  operation  had  been 
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destroyed  by  explosion,  with  a  loss  of  life  exceeding  1,000. 
Then,  between  1847  and  1852,  a  series  of  disasters  primarily 
caused  by  boiler  explosions  occurred,  in  addition  to  others 
caused  by  fires  and  collisions.2 

In  response.  Congress  passed  the  Steamboat  Act  of  1852, 
which  allowed  federal  action  on  mariners  and  made  own¬ 
ers  and  masters  liable  for  damages  resulting  from  failure  to 
employ  properly  trained  engineers.  Under  this  law,  the  orga¬ 
nization  and  form  of  a  federal  maritime  inspection  service 
began  to  emerge,  as  it  empowered  inspectors  to  grant  and 
revoke  pilots'  and  engineers'  licenses. 

This  early  system  was  supplanted  and  made  more  robust 
by  the  Act  of  1871,3  which  formed  the  Steamboat  Inspection 
Service.  This  act  provided  for  licensing  for  masters  and  chief 
mates.  It  also  made  S&R  actions  into  a  more  formal  process, 
requiring  written  notice  and  hearings.  The  Coast  Guard's 
current  licensing  enforcement  structure  is  founded  upon 
this  rich  history. 

S&R  Structure 

The  Coast  Guard's  National  Maritime  Center  (known  as 
"the  NMC")  issues  credentials  to  merchant  mariners.  Coast 
Guard  officers  in  charge  of  marine  inspection  (OCMIs)  in 
each  port  have  the  authority  to  issue  complaints  against 
those  credentials  for  various  violations;  however,  they 
do  not  have  the  authority  to  suspend  or  revoke  a  creden¬ 
tial.  That  burden  rests  with  the  Coast  Guard's  cadre  of  six 
administrative  law  judges,  who  are  charged  with  this  duty 
under  the  grounds  set  out  in  46  U.S.C.  §§7703  and  7704.  S&R 
proceedings  are  conducted  under  the  Administrative  Proce¬ 
dure  Act,4  which  ensures  that  mariners'  due  process  rights 
are  safeguarded. 

Mariners  may  appeal  administrative  law  judge  decisions 
to  the  Commandant.  They  may  also  appeal  directly  to  fed¬ 
eral  district  court  if,  for  example,  the  judge  orders  some¬ 
thing  other  than  suspension  or  revocation.  If  a  mariner  is 
unhappy  with  the  outcome  of  an  appeal  to  the  Comman¬ 
dant,  he  or  she  may  appeal  that  decision  to  the  National 
Transportation  Safety  Board,  and  then  to  the  United  States 
Court  of  Appeals,  if  still  unsatisfied. 

On  average,  500  complaints  a  year  are  filed  against  mariners. 
Suspension  and  revocation  regulations  are  constructed  to 
obtain  a  just,  speedy,  and  economical  determination  of  the 
issues  presented.  Additionally,  the  administrative  action 
against  a  merchant  mariner's  credential  is  remedial  and 
not  penal  in  nature.  In  keeping  with  its  historical  roots,  the 
Coast  Guard's  actions  are  intended  to  help  maintain  stan¬ 
dards  for  competence  and  conduct  essential  to  safety  at  sea. 
In  short.  Congress  demands  a  safer  maritime  community 
by  way  of  action  on  licenses,5  and  the  Coast  Guard  seeks  to 


accomplish  this  mission  through  its  suspension  and  revoca¬ 
tion  program. 

S&R  Triggers  that  Relate  to  SMS 

Without  belaboring  all  the  permutations  of  offenses  and 
mariner  infractions  that  might  trigger  a  suspension  and 
revocation  action,6  the  most  notable  of  all  violations  is  drug 
use.  Approximately  70  percent  of  the  500  complaints  filed 
each  year  against  mariners  involve  some  variation  of  drug 
offense.  The  rest  of  the  complaints  are  largely  composed  of 
allegations  of  misconduct  or  negligence. 

Misconduct:  This  is  mariner  behavior  that  violates  an  estab¬ 
lished  rule,  such  as  those  found  in  statutes,  regulations,  the 
common  law,  the  general  maritime  law,  a  ship's  regulation 
or  order,  or  shipping  articles.  In  addition,  the  Coast  Guard 
has  long  held  that  company  policy  with  regard  to  crew  con¬ 
duct  relative  to  safety  matters  aboard  the  ship  is  a  good 
norm  for  judging  misconduct;  they  have  successfully  pros¬ 
ecuted  numerous  complaints  against  mariners  for  violating 
their  company's  policy.7 

Negligence:  In  civil  law,  prosecutors  must  prove  several 
elements  of  negligence  to  find  liability:  that  a  duty  exists, 
the  duty  was  breached,  and  the  breach  was  the  cause  of 
resulting  damages.  However,  to  trigger  Coast  Guard  S&R 
action,  the  Coast  Guard  must  only  show  that  the  mariner 
had  a  duty  and  that  he  or  she  breached  the  duty.8  The  lack 
of  a  damage  element  makes  good  sense  in  the  world  of  S&R 
actions,  as  the  Coast  Guard  seeks  to  prevent  accidents  and 
improve  mariner  conduct  to  support  marine  safety. 

Safety  Management  Systems 
as  a  Basis  for  License  Action 

Safety  management  systems  fit  into  the  S&R  construct 
because  they  were  developed  for  the  very  reason  suspension 
and  revocation  actions  exist — to  promote  safe  ship  opera¬ 
tion.  Some  shipping  companies  are  required  to  produce  a 
safety  management  system  by  way  of  the  International  Con¬ 
vention  for  the  Safety  of  Life  at  Sea  (SOLAS)  and  U.S.  imple¬ 
menting  regulations.  Others  produce  safety  management 
systems  because  they  seek  to  standardize  safe  shipboard 
operations  and  establish  a  standard  of  care  for  their  vessels. 

Suspension  and  revocation  action  is  applicable  whether  a 
safety  management  system  is  required  or  not,  depending  on 
the  policy  or  procedure  violated.  When  a  ship  adopts  poli¬ 
cies  and  procedures  relating  to  vessel  safety,  they,  in  turn, 
establish  shipboard  regulations  and  create  the  company 
policy  against  which  a  mariner's  actions  may  be  compared. 

According  to  a  Commandant  Decision  on  Appeal,  company 
rules  are  standards  upon  which  to  measure  mariner  con¬ 
duct.  The  Commandant  has  held:  "A  company's  policy  for 
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maintenance  of  order  and  good  safety  conditions  aboard  a 
vessel,  governing  the  conduct  of  the  crew,  is  precisely  the 
kind  of  rule  that  does  establish  standards  for  the  invocation 
of  the  'misconduct'  provision  [for  S&R  proceedings]."9 

In  addition  to  misconduct  charges,  possible  S&R  enforce¬ 
ment  could  also  be  triggered  for  negligence,  as  the  SMS 
may  establish  a  standard  of  care  that  a  prudent  mariner 
is  expected  to  follow  —  a  breach  of  which,  even  without  a 
casualty,  could  result  in  allegations  being  issued. 

Getting  It  Right 

In  summary,  the  SMS  is  a  set  of  company  policies  and  rules, 
and  the  policies  are  a  good  norm  for  judging  misconduct. 
To  trigger  negligence  for  S&R  action,  the  Coast  Guard  must 
only  show  that  the  mariner  had  a  duty  and  that  he  or  she 
breached  the  duty.10 

All  this  may  cause  some  mariners  angst.  Safety  manage¬ 
ment  systems  can  be  vast,  with  so  many  rules  and  proce¬ 
dures  that  it  may  seem  impossible  to  remain  compliant  to  all 
provisions.  The  thought  of  S&R  action  stemming  from  such 
a  broad  set  of  rules  is  daunting. 

The  Coast  Guard  is  limited,  however;  it  can't  tie  just  any 
SMS  violation  to  a  suspension  and  revocation  action.  Each 
situation  is  dependent  upon  the  policy  violated  and  whether 
it  was  directly  related  to  safety  aboard  the  ship  in  the  par¬ 
ticular  situation  investigated.  Additionally,  the  Coast  Guard 
doesn't  take  its  S&R  responsibilities  lightly  —  action  upon 
the  license  could  mean  a  potential  loss  of  livelihood.  To  a 
mariner  who  depends  upon  supporting  a  career  and  earn¬ 
ing  a  paycheck  while  working  at  sea,  losing  a  credential  has 
a  serious  impact,  even  if  only  on  hold  for  a  short  while. 


But,  just  as  it's  important  that  the  Coast  Guard  gets  these 
cases  right,  due  to  the  impact  on  mariners'  livelihoods,  it's 
also  important  for  the  credentialed  fleet  to  know  the  bounds 
of  the  Coast  Guard's  authority.  To  steer  clear  of  possible  S&R 
enforcement,  a  credentialed  mariner  should  do  his  or  her 
part  to  ensure  a  safely  functioning  vessel  by  staying  up- 
to-date  on  either  the  company's  safety  management  sys¬ 
tem  rules  (if  there  is  a  formal  SMS)  or  on  the  company's 
policies  (if  no  formal  SMS  exists),  especially  as  they  pertain  to 
safety  aboard  the  ship.  Violations  of  SMS  rules  and  shipboard 
regulations  can  invoke  jurisdiction  over  their  Coast  Guard- 
issued  credential. 
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Order  EM-149. 
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Investigations  and  Safety  Management  Systems 


Putting  People  at  the  Center 

Integrating  human  factors  into 
safety  management  systems. 


by  Ms.  Dawn  M.  Gray 
Office  of  Design  and  Engineering  Standards 
Human  Element  and  Ship  Design  Division 
U.S.  Coast  Guard 


Integrating  human  factors  into  a  safety  management  system 
(SMS)  allows  a  company  to  identify  and  analyze  relevant 
human  factors  issues,  then  apply  appropriate  tools,  meth¬ 
ods,  and  measures  to  address  those  issues. 

For  example,  effectively  integrating  human  factors  elements 
into  a  safety  management  system  can: 

•  improve  staff  effectiveness  and  well-being; 

•  facilitate  appropriate  allocation  of  human  resources; 

•  contribute  to  an  overall  safety  culture; 

•  improve  training  process  effectiveness; 

•  decrease  costs  from  redesign  activities; 

•  improve  equipment  usability; 

•  provide  information  that  improves  safety  performance, 
which  reduces  risk  and  improves  SMS  effectiveness. 

This  all  results  in  the  goals  of  optimizing  performance, 
increasing  efficiency,  and  reducing  costs. 

So — what  are  these  "human  factor"  elements?  They  can  be 
grouped  into  three  main  categories: 

•  the  individual, 

•  the  job, 

•  the  organization. 

The  individual:  Elements  related  to  the 
individual  (see  Table  1)  include  factors  asso¬ 
ciated  with  people  at  all  levels  of  an  organi¬ 
zation — from  the  head  of  a  company  to  the 
seafarer  at  the  deck  plate  —  with  regard  to 
their  culture,  skills,  personality,  motivation, 
physical  build,  and  risk  perception.  While 
some  characteristics  are  fixed,  such  as  per¬ 
sonality,  physiology,  and  physical  build;  other 
characteristics  such  as  knowledge,  skills,  and 
attitudes  can  be  changed  or  improved. 


The  job:  Elements  related  to  the  job  (see  Table  2)  are  asso¬ 
ciated  with  working  conditions  and  job  design,  including 
the  work  environment,  stress,  work  schedule,  task  type, 
workload,  control  and  display  design,  and  procedures.  As 
such,  companies  should  design  tasks  to  take  account  of  the 
physical  and  mental  strengths  and  limitations  of  the  people 
performing  the  job. 

The  organization:  Elements  related  to  the  organization  (see 
Table  3)  consist  of  the  policies,  procedures,  and  methods 
that  affect  the  design  of  the  job,  including  aspects  related  to 
the  organizational  culture,  training,  manning,  leadership, 
safety  culture,  training  management,  personnel  selection, 
and  retention. 

Feedback  Loop  for 

Safety  Performance  Improvement 

How  do  human  factors  affect  the  deck  plate  level?  Incor¬ 
porating  human  factors  elements  into  a  safety  manage¬ 
ment  system  may  optimize  personnel  performance.  These 


Table  1:  Individual  Elements 

Ability  and  Behavior 

Person-Related  Conditions 

/  Knowledge/competence/attitude 

/  Personality 

/  Skills 

✓  Capabilities  (physical  and  mental) 

/  Fitness/health 

/  Risk  perception 

/  Experience 

✓  Decision-making  capabilities 

/  Communication  skills 

/  Confidence 

/  Languages 

/  Workload  management 

/  Listening  skills 

/  Culture,  beliefs,  and  values 

/  Motivation 

/  Stress 

/  Fatigue 

Adapted  from:  European  Railway  Agency,  Application  guide  for  the  design  and  implementation 
of  Railway  Safety  Management  System:  Integrating  Human  Factors  in  SMS,  ERA/GUi/10-2013/ 
SAF  V  1.0,  2013. 
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Feedback  Loop  for  Safety 
Performance  Improvement 


Human 


Therefore,  it's  important  that  organizations  integrate 
human  factors  into  the  elements  of  a  safety  manage¬ 
ment  system  that  deal  with  the  following  feedback  loop 
elements: 

•  risk  management; 

•  change  management; 

•  systems,  equipment,  and  machinery  design; 

•  task  and  job  design; 

•  safety-critical  personnel  selection  and  training; 

•  safety  reporting  and  data  analysis; 

•  incident  investigation. 

Risk  management:  Organizations  should  consider  all 
people  who  interact  with  the  system,  estimate  foresee¬ 
able  noncompliance  with  standard  operating  proce¬ 
dures,  note  abnormal  or  infrequent  modes  of  operation, 
and  recognize  how  fatigue  can  relate  to  risk.  Control 
measures  for  potential  human  error  should  focus  on 
equipment  design  and  usability;  task  and  job  design;  and 
workplace  design,  procedures,  training,  communica¬ 
tion,  teamwork,  supervision,  and  monitoring.  The  most 
effective  human  error  control  measures  either  remove  or 
modify  the  hazard. 


elements  form  a  feedback  loop  that  organizations  can  mine 
for  sources  and  potential  for  human  error.  Personnel  can 
then  address  these  through  the  SMS  risk  management 
process. 


Table  2:  Job  Elements 


Job  Design 


/  Number  and 
nature  of  tasks 

/  Complexity 

/  Repetitiveness 

/  Delegation  of 
duties 

/  Rules/ 
instructions 

/  Workload 

/  Team 

management 

/  Team  spirit 

/  Group  influence 

/  Feedback 

/  Corrective 
actions 


Design  of  Interface/ 

Rules  and 

Equipment 

Environment 

Procedures 

/  Workplace  layout 

/  Temperature 

/  Content  and  relevance 

/  Ergonomic  design  of 

/  Noise 

/  Flow 

equipment 

✓  Illumination 

/  Scope 

/  Usability  of  equipment 

/  Cleanliness 

/  Interfaces 

/  Feedback 

/  Ventilation 

/  Validity 

/  Quality  of  equipment 

/  Weather  conditions 

/  Adequate  and 

/  Inspection/ 

/  Wind 

comprehensive 

maintenance 

/  Management  of 
information 

/  Presentation  of 

outcome 

/  Humidity 

/  Vibrations 

/  Dangerous 
substances 

/  Dangerous  energy 
(i.e.  thermal, 

awareness 

/  Effort  needed 

/  Emergency 
performance 

/  Flexibility 

/  Consultation  w/staff 

electric) 

/  Testing  period 

/  External  dangers 

/  Revision 

/  Change  management 

Change  management:  Integrating  human  factors  into  the 
change  management  process  minimizes  potential  risks  by 
considering  the  impact  of  the  change  to  the  people  within 
the  system.  Further,  change  has  the  potential  to  introduce 

new  human  factor  issues 
or  even  worsen  existing 
issues,  since  changes  in 
machinery,  equipment, 
technology,  procedures, 
work  organization,  and 
work  processes  are  likely 
to  affect  human  perfor¬ 
mance. 


Systems,  equipment, 
and  machinery  design: 

Designing  and  modify¬ 
ing  human  machine  inter¬ 
faces  such  as  control  sys¬ 
tems,  alarms,  warnings, 
and  automation  within  a 
system  may  involve  sig¬ 
nificant  human  factors 
risks.  The  most  effective 
way  to  manage  this  risk  is 
to  integrate  human  factors 
and  usability  principles  in 
the  early  design  stages.1 


Adapted  from:  European  Railway  Agency,  Application  guide  for  the  design  and  implementation  of  Railway  Safety 
Management  System:  Integrating  Human  Factors  in  SMS,  ERA/GUI/10-2013/SAF  V  1.0,  2013. 
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Predicting  System -Specific  Human  Factors  Risks 


All  of  the  human  factors  elements  presented  can  positively 
and  negatively  influence  the  risk  of  human  error.  Human  Reli¬ 
ability  Analysis  (HRA)  is  a  useful  methodology  that  can  help 
predict  system-specific  human  factors  risks.1 

What  is  HRA? 

Human  reliability  is  the  probability  that  people  will  perform 
as  required  for  the  specified  time  and  environmental  condi¬ 
tions.  Human  reliability  analysis  provides  methodologies 
which  can  quantify  human  performance-related  risks  for  a 
specific  system  design.  Several  HRA  methods  are  identified 
in  the  table  below: 


How  It  Works 

The  HRA  process  involves  problem  identification,  task  anal¬ 
ysis,  error  identification,  error  modeling,  quantification, 
and  integration  into  risk  assessment.  Problem  identification 
includes  defining: 

1)  who  is  interacting  with  the  system  (and  their  mental  and 
physical  abilities); 

2)  system  configuration  being  analyzed  (i.e.  hardware  and 
software);  and 

3)  environmental  operating  conditions. 


Human  reliability  calculations  are  used  to  estimate  frequen¬ 
cies  or  probabilities  in  risk  models. 

Based  on  a  system's  individual,  job,  and  organizational  human 
factors  elements,  using  HRA  techniques  can  help  identify  the 
type  of  human  errors  that  can  occur  within  a  system  design, 
quantify  how  likely  it  is  the  identified  errors  will  occur,  and 
help  companies  reduce  those  calculated  likelihoods. 

All  of  these  factors  can  show  a  company  where  it  is  vulner¬ 
able  to  human  error.  The  company  can  then  use  SMS  elements 
to  reduce  operational  risks  and  minimize  associated  conse¬ 
quences  through  mitigation,  planning,  and 
monitoring  processes. 

How  Maritime  Companies  Can 
Learn  More  About  HRA 

Literature  on  HRA  is  available  from  many 
different  sources,  some  of  which  include 
those  cited  here: 

•  A.J.  Spurgin,  Human  Reliability  Assess¬ 
ment  Theory  and  Practice,  1st  Edition, 
2009. 

•  B.  Kirwan,  Practical  Human  Reliability 
Assessment,  Taylor  &  Francis,  1994. 

•  B.S.  Dhillon,  Human  Reliability  and  Error 
in  Transportation  Systems,  2007. 

•  Human  Reliability  Analysis  Methods 
Selection  Guidance  for  NASA,  2006 
edition. 

Additionally,  some  maritime  consulting  companies  employ 
experts  in  HRA  and  offer  HRA  services  as  well  as  other  human 
factors  analysis  services  for  identifying  and  mitigating  human 
error  opportunities. 

Endnote: 

1  B.  Kirwan,  Practical  Human  Reliability  Assessment,  Taylor  &  Francis,  1994. 

2  Human  Reliability  Analysis  Methods  Selection  Guidance  for  NASA,  2006 
edition. 


HRA  Methodology 

Description 

Human  Factors 

Process  Failure  Modes 
and  Effects  Analysis 
(HFPFMEA) 

Qualitative  technique  used  to  identify  potential 
human  errors,  error  types,  error  contributing  factors, 
and  consequences  of  error. 

Technique  for  Human 
Error  Rate  Prediction 
(THERP) 

Comprehensive  analysis  technique  used  to  perform 
preliminary  task  analysis  and  to  estimate  human  error 
probabilities.  Vessel/facility-specific  and  event-specific 
information  is  obtained. 

Human  Error 

Assessment  and 
Reduction  Technique 
(HEART) 

Simple  technique  with  available  data  based  on 
ergonomics  and  performance  research.  Error- 
producing  conditions  are  obtained  to  calculate  human 
error  probability. 

Cognitive  Reliability 
and  Error  Analysis 
Method  (CREAM) 

Flexible  technique  that  uses  task  analysis,  assessment 
of  performance  influencing  factors,  and  performance 
context  to  estimate  human  error  probability. 

Task  and  job  design:  Improving  job,  task,  and  workspace 
design  can  provide  significant  improvements  in  human 
performance.  Further,  ensuring  that  tasks  and  activities 
are  appropriately  suited  to  the  operator's  or  team's  capa¬ 
bilities  and  limitations  can  significantly  reduce  human 
error  risk.  For  example,  tasks  can  negatively  impact  human 


performance  if  they  involve  excessive  time  pressure,  com¬ 
plex  sequences  of  operations,  reliance  on  memory,  or  are 
physically  or  mentally  fatiguing.  It  is  important  to  identify 
performance  objectives  up  front  that  organizations  can 
use  to  evaluate  safety  performance  when  designing  task 
sequences  and  actions  for  safety-critical  tasks. 


www.uscg.mil/proceedings 


Spring  2016  PROCEEDINGS  |f§  57 


Table  3:  Organizational  Elements 

Work  Patterns 

Management 

Communication 

Competence 

Management 

Supervision 

✓  Structure  and  task 
allocation 

✓  Resources 

✓  Information 

/  Leadership 

/  Roles  and 
responsibilities 
/  Change  management 
/  Safety  culture 
/  Learning  organization 
/  Continuous 

improvement  spirit 

/  Structure 

/  Flow 

/  Internal 

/  External 

/  Recruitment  process 
/  Competencies/skills 
/  Training  programs 

/  Methods 

/  Re-examination  of  task 
requirements 

/  Competency  verification 
/  Performance  monitoring 

/  Monitoring 

/  Lessons  learned 

/  Management  review 

•/  Continuous 
improvement 

Adapted  from:  European  Railway  Agency,  Application  guide  for  the  design  and  implementation  of  Railway  Safety  Management  System:  Integrating  Human 
Factors  in  SMS,  ERA/GUI/10-2013/SAF  V  1.0,  2013. 

Safety-critical  personnel  selection  and  training:  It  is 

important  to  identify  and  assure  that  people  who  perform 
safety-critical  functions  are  adequately  trained.  First,  of 
course,  you  have  to  hire  them,  so  it's  important  to  identify 
the  related  knowledge,  skills,  and  attitudes  that  are  needed 
to  perform  a  specific  role  or  job.  Once  organizations  define 
the  job  competencies,  personnel  must  develop  methods  to 
select  and  train  people  based  on  these  competencies.  Fur¬ 
ther,  organizations  should  evaluate  current  employees  to 
ensure  each  has  the  appropriate  competencies,  and,  if  not, 
personnel  should  implement  training  to  bridge  any  discern¬ 
ible  gaps. 

Safety  reporting  and  data  analysis:  The  main  objective  of 
any  safety  data  collection  and  analysis  system  is  to  make 
events,  hazards,  safety  trends,  and  their  contributing  fac¬ 
tors  visible,  understandable,  and  supported  by  usable  data 
so  that  effective  corrective  action  can  be  taken.  The  behavior 
of  people  involved  in  incidents  or  near-misses  may  not  dif¬ 
fer  significantly  from  that  observed  when  accidents  occur. 
Cognitive  failures,  poor  decision  making,  communication 
breakdowns,  distractions,  and  all  other  factors  contributing 
to  accidents  will  also  be  present  in  near-misses.  Because  of 
this,  it  is  important  that  a  safety  management  system  report¬ 
ing  system  identifies  contributing  human  factors,  and  that 
personnel  within  the  company  are  trained  and  encouraged 
to  identify  and  report  them. 

Incident  investigation:  When  accidents  and  incidents  occur, 
it  is  essential  that  the  company  properly  investigates  how 
human  factors  may  have  contributed  to  the  situation.  The 
human  factors  component  of  investigation  should  be  based 
on  a  framework  for  systematic  investigations,  consider¬ 
ing  human  error  from  the  individual  and  organizational 
levels.  This  requires  that  investigators  be  trained  in  basic 
human  factors  concepts,  and  organizations  should  design 


procedures  to  examine  the  detail  of  human  performance 
factors  that  may  have  contributed  to  the  event. 

Optimizing  Overall  Performance 

Integrating  human  factors  elements  into  a  safety  manage¬ 
ment  system  provides  a  company  a  framework  to  optimize 
overall  performance  throughout  a  system  lifecycle.  While 
this  method  cannot  completely  eliminate  the  natural  haz¬ 
ards  associated  with  operating  in  an  often  harsh  and  unfor¬ 
giving  maritime  environment,  implementing  an  SMS  that 
integrates  human  factors  reduces  the  risk  to  people,  equip¬ 
ment,  and  the  environment. 
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Endnote: 

1  Industry  standards  such  as  ASTM  F-1166-07  Standard  Practice  for  Human  Engi¬ 
neering  Design  for  Marine  Systems,  Equipment,  and  Facilities;  ASTM  1337-10  Stan¬ 
dard  Practice  for  Human  Systems  Integration  Program  Requirements  for  Ships 
and  Marine  Systems,  Equipment,  and  Facilities;  ANSI/HFES  100-2007  Human 
Factors  Engineering  of  Computer  Workstations;  and  ANSI/HFES  200  Human 
Factors  Engineering  of  Software  User  Interfaces  are  useful  sources  for  system  and 
human  machine  interface  design  guidance. 
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In  this  ongoing  feature,  uie  take  a  close  look  at  recent  marine  casualties.  Ule  outline 
the  U.S.  Coast  Guard  marine  casualty  inuestigations  that  followed,  which  explore  how 
these  incidents  occurred,  including  any  environmental,  vessel  design,  or  human  error 
factors  that  contributed  to  each  event. 


Article  information,  statistics,  conclusions,  and  quotes  come  from  the  final, 
promulgated  Coast  Guard  investigation  report. 


Deadly  Fun 
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On  May  30,  2010,  a  woman  went  out  on  the 
Ohio  River  with  a  personal  watercraft  for 
some  fun.  Instead,  she  lost  her  life  after 
crossing  paths  with  a  vessel  and  its  tow. 

On  September  28,  2013,  a  man  and  a 
woman  rented  a  personal  watercraft  for  a 
tour.  The  male  driver,  who  had  little  expe¬ 
rience  in  properly  operating  a  personal 
watercraft,  made  a  hard  turn  right  into  the 
center  tunnel  of  a  tour  boat’s  catamaran 
hull  —  ultimately  ejecting  both  riders  from 
the  personal  watercraft  and  into  the  water. 
Both  died  from  the  collision. 

Operator  inattention,  improper  lookout, 
operator  inexperience,  excessive  speed, 
and  machinery  failure  rank  as  the  top  five 
primary  contributing  factors  in  recreational 
boating  accidents.1 


Story  1:  A  Day  on  the  River 


On  a  Sunday  afternoon  over  Memorial  Day  weekend,  a 
group  of  three  arrived  at  a  riverboat  ramp  with  a  personal 
watercraft  (PWC).  The  group  launched  the  personal  water¬ 
craft  with  all  three  aboard,  then  headed  toward  a  beach 
approximately  2.5  miles  downriver.  They  arrived  about  five 
minutes  later  and  dismounted  the  PWC  to  enjoy  some  rec¬ 
reation  on  the  beach. 

Around  the  same  time,  the  mate  of  an  uninspected  towing 
vessel  (UTV)  relieved  the  navigation  watch  and  prepared 
to  get  underway  with  a  tow  configuration  totaling  approxi¬ 
mately  1,128  feet.  While  traveling  upbound  with  a  14-barge 
tow,  the  mate  acted  as  the  sole  lookout  from  the  wheelhouse. 

Approximately  an  hour  later,  one  woman  from  the  personal 
watercraft  trio  asked  the  owner  if  she  could  ride  the  recre¬ 
ational  vessel  solo.  The  owner  said,  yes,  she  could,  but  that 
two  friends  were  back  at  the  boat  ramp  awaiting  a  ride  to 
the  beach.  The  woman  agreed  to  pick  up  the  friends  and 
was  last  seen  aboard  the  PWC  traveling  upbound  at  a  high 
rate  of  speed.2 

The  PWC  operator  set  her  vessel  on  a  parallel  course  to  the 
uninspected  towing  vessel,  moving  at  50  to  70  miles  per 
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hour,  and  she  soon  overtook  the  UTV  and  its  tow,  crossing 
its  trackline. 

Somehow,  the  woman  either  fell  or  was  ejected  from  the 
personal  watercraft.  A  Coast  Guard  marine  investigator  and 
boating  accident  investigator  used  evidence  and  testimony 
to  piece  together  the  woman's  final  hours.  According  to  the 
report  of  investigation,  it's  suspected  that  she  engaged 
the  bow  wake  of  the  tow  being  pushed  upriver  at  a  high  rate 
of  speed.  The  reaction  of  the  PWC  at  the  point  of  engage¬ 
ment  with  this  wake  was  unpredictable  and  dependent  on 
the  operator's  inputs,  such  as  throttle  control  and  weight 
distribution,  leading  investigators  to  believe  that  the  oper¬ 
ator  lost  control  of  the  personal  watercraft,  sustained  an 
incapacitating  injury,  and  fell  from  the  personal  watercraft 
directly  in  front  of  the  tow. 

The  river  current  then  carried  the  personal  watercraft  and 
the  woman  in  front  of  the  head  of  the  tow,  where  both  col¬ 
lided  with  an  empty  tank  barge.  The  tank  barge  was  posi¬ 
tioned  at  the  head  of  the  port  string  of  barges  being  pushed 
ahead  by  the  tow  vessel.  The  PWC  soon  emerged  on  the 
tow's  port  side. 
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According  to  testimony,  the  mate  aboard  the  UTV  never  saw 
the  personal  watercraft  with  the  operator  aboard,  nor  did  he 
see  the  PWC  overtake  his  vessel.  Once  the  PWC  surfaced, 
another  crewmember  aboard  the  towing  vessel  reported  it 
to  the  mate  and  advised  him  there  was  no  operator  aboard, 
nor  did  he  see  anyone  in  the  water.  He  also  reported  he 
didn't  see  any  visible  signs  of  damage  to  the  watercraft, 
though  investigators  later  discovered  damage  to  its  port 
side — cracked  fiberglass,  transfer/scratches  on  the  cowling 
port /forward. 

It  wasn't  until  more  than  three  hours  later  that  the  personal 
watercraft  operator  surfaced.  She  was  wearing  a  lifejacket 
and  floating  in  between  the  first  and  second  barges  of  the 
port  string  of  barges  in  tow.  The  deckhands  aboard  the  tow¬ 
ing  vessel  retrieved  the  woman  and  presumed  her  deceased 
as  a  victim  of  drowning.  They  placed  her  in  blankets,  covered 
her,  and  prayed.  Emergency  medical  services  arrived  on  the 
scene  shortly  thereafter,  boarded  the  tow,  and  confirmed  no 
signs  of  life.  Medics  transported  the  victim  ashore  for  medi¬ 
cal  evaluation,  identification,  and  next-of-kin  notification. 
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Personal  Watercraft  Data:  A  Five-Year  Study  (2009-2013) 


Each  year,  the  Coast  Guard  receives  reports  of  accidents  that 
occur  on  U.S.  waterways.  Personal  watercraft  safety  is  a  hot 
topic  for  good  reason,  as  indicated  by  the  following  findings: 

•  Personal  watercraft  account  for  roughly  one-fifth  of 
the  vessels  involved  in  these  accidents,  ranking  second 
behind  open  motorboats. 

O  There  are  roughly  1,000,000  PWCs  registered  in  the 
U.S.,  which  is  9  percent  of  motorized  vessel  registra¬ 
tion  and  less  than  5  percent  of  the  overall  number  of 
recreational  vessels. 


had  someone  either  forcibly  ejected  from  the  boat  or 
someone  who  fell  off  the  boat  as  the  first  event  in  the 
accident.  Oftentimes,  a  person  will  suffer  an  injury  from 
impacting  the  handlebars  after  hitting  a  wave,  or  suffer 
an  injury  from  getting  a  foot  stuck  while  being  ejected. 
Very  rarely,  serious  internal  injury  can  occur  when  a 
person  falls  off  the  back  of  the  PWC  and  into  the  path  of 
its  high-pressure  water  jet. 

•  There  have  been  an  average  of  44  deaths  a  year  on  PWC. 
Trauma  is  the  most  frequently  listed  cause  of  death, 
accounting  for  more  than  half  of  this  number. 


O  Deaths  on  PWCs  represent  6.5  percent  of  deaths; 
injuries  on  PWCs  make  up  24.5  percent  of  injured 
victims. 

•  Collisions  with  other  vessels  are  common  accident  occur¬ 
rences;  roughly  60  percent  of  all  personal  watercraft 
involved  in  accidents  occur  in  this  manner.  Many  times, 
PWC  operators  fail  to  keep  a  proper  lookout,  and  quite 
frequently,  two  or  more  personal  watercraft  operators 
loop  around  each  other  playfully  at  high  speeds.  When 
one  operator  turns  sharply  and  lets  off  the  gas,  a  shield 
of  spray  hinders  the  other's  ability  to  see  well.  With  this 
lack  of  visibility,  the  other  operator  doesn't  know  to  take 
evasive  action,  leading  to  a  crash. 

•  Many  other  collisions  are  caused  by  inexperience.  Many 
PWCs  do  not  allow  the  user  to  steer  the  boat  without  the 
throttle  engaged;  consequently,  if  an  operator  sees  that 
a  crash  is  imminent,  often  his  or  her  gut  reaction  is  to 
let  off  the  throttle  and  turn.  However,  when  the  oper¬ 
ator  lets  off  the  throttle,  he  or  she  usually  loses  steering 
ability,  and  the  vessel  continues  in  the  same  direction 
as  before,  often  crashing  into  the  thing  the  operator 
was  trying  to  avoid.  Luckily,  many  new  personal  water¬ 
craft  are  designed  to  provide  the  operator  with  steering 
ability  even  if  he  or  she  chooses  to  let  off  the  throttle. 

•  Falling  out  of  the  boat,  either  by  force  (for  example, 
when  a  wave  hits  a  boat)  or  by  gravity,  is  another 
common  occurrence  involving  PWCs.  Roughly  one  out 
of  every  six  personal  watercraft  involved  in  an  accident 


Story  2:  Excursion  Gone  Wrong 


On  Saturday,  September  28,  2013,  a  man  and  a  woman 
rented  a  personal  watercraft  around  5:45  p.m.  in  Clearwater, 
Florida,  as  part  of  a  "One-Hour  Free  Play"  package.  During 
the  excursion  orientation,  the  man  said  he'd  had  experience 
operating  a  personal  watercraft  in  India.  The  renters  put  on 
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There  have  been  more  than  700  injured  victims  a  year 
on  PWCs.  Common  injuries  include  broken  bones,  cuts, 
bruises,  concussions,  and  sprains/strains. 

Personal  watercraft  operators  range  in  age  from  preteens 
to  senior  citizens  approaching  their  80s.  The  average  age 
of  operators  involved  in  PWC  fatalities  is  37  years  old.  The 
average  age  of  operators  sustaining  injuries  in  nonfatal 
accidents  is  31  years  old. 


O  In  fatal  and  nonfatal  injury  accidents,  the  average 
age  of  PWC  operators  (37  and  31,  respectively,  as 
described  in  the  bullet  above)  was  much  lower  than 
the  average  age  for  all  boats  combined.  The  average 
age  of  operators  in  fatal  accidents  was  46;  39  years 
old  was  the  average  for  nonfatal  accidents.  House¬ 
boat  and  sailboat  operators  had  the  highest  average 
age  of  operators,  and  for  both  fatal  and  nonfatal 
accidents,  50-plus  was  the  average  age  of  operators 
on  these  craft. 

O  The  average  age  of  deceased  PWC  victims  is  35  years 
old.  The  average  age  of  injured  victims  on  personal 
watercraft  is  28  years  old,  which  is  much  lower  than 
the  average  age  of  victims  on  all  boats  combined. 
The  average  age  of  a  deceased  victim  is  44  years  old, 
and  the  average  age  of  an  injured  victim  is  34  years 
old. 
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personal  flotation  devices,  and  the  rental  company  provided 
an  orientation  detailing  the  proper  operation  of  the  vessel 
and  a  description  of  the  tour.  The  man  and  woman  then 
left  the  marina,  led  by  a  tour  guide  who  was  on  a  separate 
personal  watercraft. 


Spring  2016  PROCEEDINGS  |f§  61 


* 

ft 


PWC  Manufacturing 
Safety  Developments 


/a 


Some  personal  watercraft  manufacturers  have  developed 
additional  features  to  help  protect  riders. 

Off-throttle  steering  (OTS)  allows  PWC  operators  greater 
maneuverability  when  off  throttle  or  off  power.  Prior  to  the 
introduction  of  OTS,  operators  would  often  lose  the  ability  to 
steer  the  PWC  without  the  throttle  engaged. 

Braking  systems  allow  the  operator  to  bring  the  PWC  to 
a  controlled  stop  on  demand.  Prior  to  the  introduction  of 
braking  abilities,  an  operator  would  have  to  disengage  the 
throttle  and  coast  to  a  stop. 


Both  of  these  developments  have  undoubtedly  prevented 
collisions  and  allisions. 


The  PWC  operators  were  transiting  to  the  designated  "free 
play"  area.  Once  the  vessels  cleared  the  marina's  no-wake 
zone,  the  tour  guide  checked  with  them  to  see  if  they  were 
ready  to  increase  speed  and  proceed  by  following  him  to  the 
designated  area.  Both  PWCs  increased  speed;  however,  the 
rental  operator  released  the  throttle  shortly  after  getting  the 
vessel  up  on  plane. 


The  tour  guide  circled  back  to  assess  whether  the  operator 
was  in  control  of  the  vessel  and  to  confirm  once  again  that 
they  were  ready  to  continue.  After  receiving  this  confirma¬ 
tion,  the  tour  guide  accelerated  and  proceeded  southeast 
on  the  causeway  channel  across  the  intersection  of  the  Bird 
Island  Shortcut  Channel.  At  the  same  time,  a  tour  vessel 
approached  the  intersection  via  the  shortcut  channel  from 
the  south. 

The  rental  operator  followed  the  tour  guide  down  the  cause¬ 
way  channel,  but  his  own  vessel's  course  made  a  slight 
arching  turn  to  starboard  in  the  direction  of  the  tour  boat. 
Observing  the  irregular  behavior  of  the  rental  operator's 
personal  watercraft,  the  tour  boat's  master  declutched  the 
vessel's  engines,  but  momentum  continued  to  carry  the  tour 
boat  forward. 


The  operator  of  the  rented  personal  watercraft  seemed  to 
identify  the  threat  of  collision.  Video  evidence  reveals  that 
he  made  a  series  of  throttle  adjustments  over  a  period  of 
1.9  seconds,  as  indicated  by  the  intensity  level  of  the  water 
propulsion  discharge.  He  applied  throttle,  lessened  or 
released  throttle,  and  then  applied  throttle  just  a  few  sec¬ 
onds — and  a  few  feet — prior  to  impact. 
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At  the  point  of  extremis  and  with  significant  throttle,  the 
PWC  operator  made  a  hard  turn  to  starboard  and  collided 
into  the  center  tunnel  of  the  catamaran  hull  of  the  tour  boat. 
Both  riders'  bodies  impacted  the  deck  and  port  hull  of  the 
tour  boat,  ejecting  them  from  the  personal  watercraft. 

Their  bodies  surfaced  off  the  stern  of  the  tour  boat,  unre¬ 
sponsive.  The  PWC  tour  guide  recovered  both  victims  and 
transferred  them  to  the  tour  boat,  where  some  of  the  vessel's 
passengers  and  crew,  including  a  fire  rescue  first  responder, 
began  CPR.  The  victims  were  ultimately  transported  back  to 
the  shore,  where  they  were  pronounced  dead. 

Post-casualty  assessment  and  witness  testimony  indicate 
that  the  personal  watercraft  involved  in  the  incident  was  in 
sound  mechanical  condition  prior  to  the  collision,  and  that 
mechanical  failure  did  not  appear  to  be  a  causal  factor. 


Lessons  Learned 


Story  1:  A  Day  on  the  River 

The  woman  aboard  the  personal  watercraft  had  no  boating 
safety  training  and  likely  no  knowledge  of  the  "rules  of  the 
road."  She  most  likely  made  the  decision  to  overtake  the  tow 
to  reach  the  flat,  calm  water  in  front  of  the  tow.  However,  the 
speed  of  both  vessels  as  well  as  the  bow  wake  from  the  head 
of  all  tows  present  elements  that  all  vessel  operators  must 
consider  before  overtaking  a  tow  and  tow  vessel. 

Moreover,  the  mate/pilot  aboard  the  uninspected  towing 
vessel  was  fatigued  the  day  of  the  incident.  His  employer 
had  transferred  the  mate  from  one  vessel  to  another,  which 
resulted  in  fragmented  sleep  the  morning  of  the  collision. 
The  pilot  only  slept  for  approximately  three  hours  the  pre¬ 
vious  night,  versus  the  five  and  a  half  hours  he  had  grown 
accustomed  to  the  three  days  before  that.  He'd  also  had  a 
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five-hour  van  ride  prior  to  becoming  the  operator  and  sole 
lookout  of  the  towing  vessel.  While  western  rivers  tow  ves¬ 
sel  operators  commonly  operate  as  the  steersman  as  well 
as  their  own  lookout,  this  incident  occurred  over  Memorial 
Day  weekend,  when  recreational  vessel  traffic  on  the  water¬ 
way  was  known  to  be  heavy. 

Story  2:  Excursion  Gone  Wrong 

The  watercraft  operator  on  the  rental  lacked  the  boating 
skills  required  to  operate  a  personal  watercraft  effectively. 

According  to  witness  testimony,  the  man  who  rented  the 
PWC  indicated  he  had  operated  one  in  the  past,  but  the 
extent  of  that  experience  was  suspected  to  be  limited  and 
not  recent.  In  situations  where  an  inexperienced  PWC  renter 
may  have  to  pass  through  a  heavily  navigated  channel,  a 
check  ride  in  an  isolated  area  is  recommended. 

Further,  Florida  law  requires  PWC  liveries  to  provide  an  on- 
the-water  demonstration  and  check  ride  to  evaluate  renter 
proficiency.  The  PWC  rental  company  personnel  may  have 
believed  they  met  this  requirement  by  requiring  a  guide  to 
instruct  and  escort  all  renters.  However,  with  the  business' 
location  set  in  a  busy  marina,  renters  were  immediately 
exposed  to  high  levels  of  commercial  and  recreational  traf¬ 
fic  before  they  could  demonstrate  or  learn  vessel  proficiency. 

In  this  situation,  the  rental  company  did  provide  an  orienta¬ 
tion  describing  PWC  controls,  characteristics,  and  handling. 
However,  until  they  actually  climb  aboard  a  PWC  and  get 


adequate  practice,  new  and  less  experienced  operators  don't 
get  the  hands-on  experience  necessary  to  learn  how  the  ves¬ 
sel  will  react  to  throttle  and  steering  changes. 

Personal  watercraft  are  unique,  in  that  throttle  is  usually 
necessary  to  steer  the  vessel.  This  characteristic  is  often  cov¬ 
ered  in  new  rider  orientations  and  helps  to  explain  why  the 
PWC  operator  continued  to  increase  the  throttle  application 
as  he  attempted  to  steer  out  of  the  situation. 
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2-  Note:  At  60  miles  per  hour,  a  personal  watercraft  can  travel  1,000  feet  in  approxi¬ 
mately  13.6  seconds,  and  a  half-mile  in  30  seconds. 
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1.  Which  of  the  following  actions  must  be  carried  out  before  a  voltage  tester  can  be  used  to  test  the  three  line  fuses  to 
a  three-phase  motor? 

A.  The  fuses  must  be  removed  from  the  circuit. 

B.  The  starter  must  be  placed  in  the  STOP  position  to  stop  and  disconnect  the  motor. 

C.  The  three  line  connections  in  the  motor  terminal  box  must  be  disconnected  and  tagged. 

D.  Nothing  need  be  done  as  long  as  the  motor  is  running  under  a  light  load. 


2.  The  instrument  always  used  in  conjunction  with  a  salinometer  is  a 

A.  pyrometer 

B.  thermometer 

C.  hygrometer 

D.  hydrometer 


3.  Which  of  the  listed  diesel  engine  starting  systems  is  most  susceptible  to  difficulties  in  cold  weather? 

A.  direct  cylinder  admission  air  start 

B.  hydraulic 

C.  electric 

D.  air  motor  starting 


4.  The  formation  of  a  pit  in  a  boiler  tube  is  most  likely  to  occur  when 

A.  waterside  deposits  are  present 

B.  sludge  is  present 

C.  dissolved  oxygen  is  present 

D.  the  tube  metal  acts  as  a  cathode 
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1.  BOTH  INTERNATIONAL  &  INLAND:  Which  vessel  would  sound  a  fog  signal  consisting  of  the  ringing  of  a  bell 
for  5  seconds? 

A.  a  vessel  engaged  in  fishing,  at  anchor 

B.  a  vessel  restricted  in  its  ability  to  maneuver,  at  anchor 

C.  a  sailing  vessel,  at  anchor 

D.  all  of  the  above 


2.  You  are  en  route  to  assist  vessel  A.  Vessel  A  is  underway  at  6  knots  on  course  133°T,  and  bears  042°  at  a  range  of 
105  miles.  What  is  the  course  to  steer  at  10  knots  to  intercept  vessel  A? 

A.  063° 

B.  068° 

C.  073° 

D.  079° 


3.  You're  on  a  ship  that  has  broken  down  and  is  preparing  to  be  taken  in  tow.  You  will  use  your  anchor  cable  as  part  of 
the  towline.  Which  statement  is  TRUE? 

A.  The  anchor  cable  should  be  veered  enough  to  allow  the  towline  connection  to  be  just  forward  of  your  bow. 

B.  The  anchor  cable  should  be  veered  enough  to  allow  the  towline  connection  to  be  immediately  astern  of  the  towing 
vessel. 

C.  The  strain  of  the  tow  is  taken  by  the  riding  pawl,  chain  stopper,  and  anchor  windlass  brake. 

D.  The  anchor  cable  should  be  led  out  through  a  chock,  if  possible,  to  avoid  a  sharp  nip  at  the  hawsepipe  lip. 


4.  Which  statement  is  TRUE  about  sail  shape? 

A.  You  can  move  the  belly  up  in  a  mainsail  by  easing  the  luff  tension. 

B.  A  high-aspect  ratio  Marconi  mainsail  is  more  efficient  for  downwind  sailing  than  a  gaff-rigged  mainsail. 

C.  You  can  reduce  the  belly  in  a  boomed  mainsail  by  easing  the  sheet. 

D.  You  should  put  more  belly  in  a  sail  in  light  airs  than  in  a  strong  breeze. 
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Note:  The  line  fuses  supplying  a  three-phase  motor  may  be  tested  off-line  using  a  voltage  tester  or  a  multi-meter  set  up  as  a  voltmeter. 


A.  The  fuses  must  be  removed  from  the  circuit. 

B.  The  starter  must  be  placed  in  the  STOP 
position  to  stop  and  disconnect  the  motor. 

C.  The  three  line  connections  in  the  motor 
terminal  box  must  be  disconnected  and 
tagged. 

D.  Nothing  need  be  done  as  long  as  the  motor 
is  running  under  a  light  load. 


Incorrect  answer.  To  test  the  fuses  on-line  using  a  voltage  tester,  the 
fuses  must  remain  in  the  circuit. 

Correct  answer.  The  motor  must  be  stopped  to  prevent  back-feeding 
of  voltage  to  the  bottoms  of  the  fuses,  which  would  result  in  errone¬ 
ous  voltage  readings. 

Incorrect  answer.  To  test  the  fuses  on-line  using  a  voltage  tester,  the 
line  connections  to  the  fuses  must  be  connected  to  the  fuses  and  the 
line  connections  must  be  energized. 

Incorrect  answer.  The  motor  must  be  stopped.  See  explanation  for 
choice  "B." 


2.  Note:  A  salinometer  is  an  instrument  used  to  measure  the  chloride  (salt)  content  of  a  solution.  It  measures  the  electrical  conductivity  of  the  solution,  which 
is  proportional  to  the  chloride  content.  For  accuracy,  the  salinometer  reading  must  be  corrected  for  temperature. 


A.  pyrometer 

B.  thermometer 

C.  hygrometer 

D.  hydrometer 


Incorrect  answer.  A  pyrometer  is  used  to  measure  very  high  temperatures,  such  as  diesel 
engine  exhaust  and  boiler  stack  temperatures. 

Correct  answer.  An  ordinary  thermometer  is  used  to  correct  for  the  effects  of  temperature. 
Incorrect  answer.  A  hygrometer  is  used  to  measure  the  moisture  content  of  the  atmosphere. 
Incorrect  answer.  A  hydrometer  is  used  to  measure  the  specific  gravity  of  a  liquid. 


3. 


Note:  While  cold  weather  starting  of  diesel  engines  can  be  difficult  due  to  the  thickness  of  the  lubricating  oil,  this  can  be  compounded  by  a  reduction  in 
torque  that  the  starting  system  provides. 


A.  direct  cylinder 
admission  air  start 

B.  hydraulic 

C.  electric 


D.  air  motor  starting 


Incorrect  answer.  The  starting  torque  produced  is  primarily  a  function  of  the  piston  crown 
area  and  the  starting  air  pressure,  which  are  not  significantly  affected  by  cold  temperature. 
Incorrect  answer.  The  starting  torque  produced  is  primarily  a  function  of  hydraulic  motor 
piston  area  and  the  starting  hydraulic  pressure,  which  are  not  significantly  affected  by  cold 
temperature. 

Correct  answer.  The  starting  torque  is  primarily  a  function  of  the  battery's  internal  resis¬ 
tance  and  the  specific  gravity  of  the  electrolytes,  which  are  significantly  affected  by  cold 
temperature. 

Incorrect  answer.  The  starting  torque  produced  is  primarily  a  function  of  the  air  starting 
motor  vane  area  and  the  starting  air  pressure,  which  are  not  significantly  affected  by  cold 
temperature. 


4.  Note:  Pitting  on  the  inside  of  boiler  tubes  is  generally  the  result  of  oxidation  corrosion. 


A.  waterside  deposits 
are  present 

B.  sludge  is  present 

C.  dissolved  oxygen  is 
present 

D.  the  tube  metal  acts 
as  a  cathode 


Incorrect  answer.  Waterside  deposits  generally  result  when  the  mineral  content  of  the  boiler 
water  causes  hard  scale  formation. 

Incorrect  answer.  Sludge  accumulations  are  generally  the  result  of  soft  precipitates  forming 
in  the  boiler  water  as  a  result  of  boiler  water  treatment  for  scale  control.  Sludge  settles  to  the 
bottom  of  the  boiler. 

Correct  answer.  Excess  dissolved  oxygen  in  boiler  water  causes  localized  pitting  corrosion 
in  the  boiler  tubes.  Excess  dissolved  oxygen  can  be  caused  by  defective  deaeration  equip¬ 
ment  or  inadequate  dosage  with  oxygen  scavenger  treatment  chemicals. 

Incorrect  answer.  Galvanic  corrosion  in  modern  boilers  is  generally  not  problematic  due  to 
the  avoidance  of  constructing  boilers  with  dissimilar  metals.  Any  corrosion,  however  neg¬ 
ligible,  would  be  at  the  anode.  The  cathode  would  be  protected. 
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1.  A.  a  vessel  engaged  in  fishing,  at  anchor  Incorrect  answer. 

B.  a  vessel  restricted  in  its  ability  to  maneuver,  at  anchor  Incorrect  answer. 

C.  a  sailing  vessel,  at  anchor  Correct  answer. 

"A  vessel  at  anchor  shall  at  intervals  of  not  more  than  1  minute  ring  the 
hell  rapidly  for  about  5  seconds." 

Reference:  International  and  Inland  Rule  35(g). 

D.  all  of  the  above  Incorrect  answer. 


2.  A. 

063° 

Incorrect  answer. 

B. 

o 

00 

KD 

o 

Incorrect  answer. 

C. 

073° 

Incorrect  answer. 

D. 

o 

3 

o 

Correct  answer. 

Where:  A  =  "The  angular  difference  between  the  target  vessel's  true  course  and  the  true  bearing  of  your  vessel 
from  the  target  vessel." 

A  =  133°  -  (42°  +  180°) 

A  =  89°  (make  this  value  positive  for  calculator  solution) 

Target  speed  =  6  knots 
Own  vessel  speed  =  10  knots 

Sin  of  the  intercept  angle  =  (target  speed  x  sin  A)  +  (your  speed) 

Sin  intercept  angle  =  (6  x  sin  89°)  4  (10) 

Intercept  angle  =  36.86° 

True  course  to  steer  =  intercept  angle  (±)  target  bearing 

(positive  if  target  bearing  falls  to  the  right,  and  negative  if  target  bearing  falls  to  the  left) 

True  course  to  steer  =  36.9°  +  42°  =  78.9° 

Reference:  Richard  M.  Plant,  Formula  for  the  Mariner,  2nd  Ed.,  p.  32. 


3.  A.  The  anchor  cable  should  be  veered  enough  to  allow 
the  towline  connection  to  be  just  forward  of  your  bow. 

B.  The  anchor  cable  should  be  veered  enough  to  allow 
the  towline  connection  to  be  immediately  astern  of 
the  towing  vessel. 

C.  The  strain  of  the  tow  is  taken  by  the  riding  pawl, 
chain  stopper,  and  anchor  windlass  brake. 


D.  The  anchor  cable  should  be  led  out  through  a  chock, 
if  possible,  to  avoid  a  sharp  nip  at  the  hawsepipe  lip. 


Incorrect  answer. 
Incorrect  answer. 


Correct  answer. 

"If  the  anchor  cable  is  used,  the  hawser  is  secured  or  shackled  to  it  and  the 
cable  veered  away  to  the  desired  length;  the  windlass  brakes  are  then  set  up 
and  springs  or  chain  stoppers  used  to  take  the  real  strain  of  towing." 
Reference:  John  V.  Noel,  Jr.,  Knights  Modern  Seamanship,  17th  Ed., 
p.  303. 

Incorrect  answer. 


.  A. 

You  can  move  the  belly  up  in  a  mainsail  by 
easing  the  luff  tension. 

Incorrect  answer. 

B. 

A  high-aspect  ratio  Marconi  mainsail  is  more 
efficient  for  downwind  sailing  than  a  gaff- 
rigged  mainsail. 

Incorrect  answer. 

C. 

You  can  reduce  the  belly  in  a  boomed  mainsail 
by  easing  the  sheet. 

Incorrect  answer. 

D. 

You  should  put  more  belly  in  a  sail  in  light  airs 

Correct  answer. 

than  in  a  strong  breeze. 

"A  slack  foot  introduces  more  belly  into  the  sail,  especially  in  the  lower  part  of 
the  sail.  This  is  desirable  for  light  winds,  when  the  airflow  can  remain  attached 
(laminar)  over  a  deeper  curve  than  in  stronger  winds." 

Reference:  G.  Andy  Chase,  Auxiliary  Sail  Vessel  Operations,  p.  55. 
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